Common Ransomware Ports: What to Check and Close

Short answer: A 2021 CISA advisory listed phishing and brute-forcing unsecured Remote Desktop endpoints (TCP 3389) as the two most prevalent ransomware initial access vectors, and a 2022 advisory reports MedusaLocker actors most often gaining access through vulnerable RDP configurations. SMB (TCP 445), together with the NetBIOS ports 139, 137 and 138, is what the 2017 WannaCry outbreak used to spread between machines. Neither should be reachable from the internet.

There is no universal list of ransomware ports. This guide covers the ports named in the advisories listed below; other services matter in other incidents, and the mix of entry points changes over time.

A port is a symptom, not the cause

CISA's advisories describe several ways in. One names the two most prevalent ransomware initial access vectors as phishing and brute-forcing unsecured Remote Desktop Protocol (RDP) endpoints, and lists others: precursor or dropper malware, exploitation of software and operating system vulnerabilities, exploitation of managed service providers with access to customer networks, and valid stolen credentials. Another calls open ports and misconfigured services exposed to the internet one of the most common vulnerability findings.

Closing a port removes one exposure. It does not stop phishing or stolen passwords.

The ports, and why they appear in advisories

How to read this table: port numbers describe observed behavior in specific campaigns. They are indicators of exposed services, not a ranking of how often each port is abused, and a service moved to another port is still the same service (Microsoft notes the RDP port can be changed).

Not every way in is a port you can close

CISA's 2026 advisory on Gunra ransomware reports initial access primarily through exploitation of known vulnerabilities in internet-facing devices, including firewall and VPN appliances, and recommends prioritizing patches for known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. For those devices, patching and access control matter as much as closing ports.

How to check what you expose

From outside your network

Scanning your own public IP addresses from outside your network gives the best view of internet-facing exposure. Scans from inside can differ because of routing, NAT and firewall policies, and a single outside vantage point may not reflect rules that depend on the source address or location. Only scan systems you own or have written permission to test.

Check TCP first (Nmap's default), then UDP: RDP can also use UDP 3389, and the NetBIOS ports include UDP 137 and 138.

Replace 203.0.113.10 (a reserved documentation address) with your own. In the results, open means something answered. filtered means something, usually a firewall, blocked the probes, so Nmap can't tell whether the port is open; it is not proof that the service behind it is secure. For UDP, open|filtered means no response came back, which can mean an open port or a dropped probe.

On a host

To see whether a machine is actually listening on a port, filter on the local port and the listening state instead of searching the output for the number. A text search for :445 also matches ports such as 4450 and, on Windows, existing connections to a remote port 445.

On Windows, if nothing matches, these cmdlets print an error saying that no matching objects were found instead of returning an empty list. Read that as "nothing is listening on that port"; adding -ErrorAction SilentlyContinue hides the message.

For what any other port number is registered for, use the Port Lookup tool.

What to close or tighten

1. Don't leave RDP directly reachable from the internet. CISA's guidance is to restrict RDP, use virtual desktop infrastructure, and disable ports and protocols not used for a business purpose; its own example is RDP on TCP 3389.
2. Log and lock out. Monitor remote access and RDP logs, log RDP login attempts, and enforce account lockouts after a set number of failed attempts.
3. Require multi-factor authentication on remote access, especially RDP. CISA notes that MFA, particularly for remote desktop access, can help prevent account takeovers.
4. Block SMB at the perimeter. Microsoft's guidance is to block unsolicited inbound and outbound internet traffic on TCP 445 and UDP 137 and 138, allowing only the specific endpoints that need it. CISA's WannaCry alert names TCP 139 in the same boundary rule.
5. Disable SMBv1 and patch. WannaCry spread by exploiting SMBv1 (MS17-010), and CISA's alert lists disabling SMBv1 among its mitigations where the patch cannot be applied. More broadly, prioritize patching known exploited vulnerabilities in internet-facing systems, as CISA's Gunra advisory recommends.
6. Re-check whether each internet-facing service is still needed. CISA recommends continuously assessing the business and mission need of internet-facing services.
7. Train users to recognize and report phishing. Firewall rules don't address it, and CISA's MedusaLocker advisory lists it among its actions to take today.

Related

• Port 3389 — Remote Desktop Protocol
• Port 445 — SMB
• Port Lookup — what any port number is registered for
• Subnet / CIDR Calculator — work out address ranges for firewall allow-lists

References

• CISA: Ransomware Awareness for Holidays and Weekends (AA21-243A)
• CISA: Weak Security Controls and Practices Routinely Exploited for Initial Access (AA22-137A)
• CISA: #StopRansomware: MedusaLocker (AA22-181A)
• CISA: #StopRansomware: Gunra Ransomware (AA26-222A)
• CISA: Indicators Associated With WannaCry Ransomware (TA17-132A)
• Microsoft: Preventing SMB traffic from lateral connections and entering or leaving the network
• Microsoft Learn: Ports that are used by Remote Desktop Services

Last reviewed: October 26, 2026. This guide summarizes the public advisories listed above. The notes on how to check and apply them are this site's own editorial content, not official CISA or Microsoft guidance.