We run a small office network with Windows SBS 2011 and Draytek Vigor 3300 router. We recently had a ransomware attack in which it currently appears the payload was run on the SBS server itself.
Since no users log in to the machine, and it doesn't run email client or a web browser, the most likely loophole would appear to be some remote desktop session or other access through the VPN ports.
We had these open, NAT redirected to the server:
Is this a reasonable attack point, or should I be looking elsewhere? As additional evidence, the attack appeared to take place out of office hours with all client pc's turned off. The only other components would be the router, switches, printers etc. With hindsight, the router and administrator passwords might have been susceptible to brute force attack - although the server was set to 30s before permitting a failed password retry, making that seem very unlikely.