# Identity Attacks Overtake Exploits as Top Ransomware Cause (Sophos State of Ransomware 2026)

> Sophos' State of Ransomware 2026 report (2,158 IT/security leaders, 17 countries, organizations hit by ransomware in the past 12 months) finds 79% of ransomware attacks now start with an identity-based approach — malicious email (26%) and phishing (24%) have displaced exploited vulnerabilities (18%, down from 32% in 2025) as the leading root causes for the first time in four years. Companion Sophos research (Active Adversary Report 2026, State of Identity Security 2026) corroborates the shift: 67% of 661 IR/MDR cases traced to identity weaknesses, MFA was absent in 59% of those cases, and 97% of credential-root-cause ransomware incidents had MFA deployed somewhere — pointing to incomplete MFA coverage (VPNs, firewall admin consoles, legacy apps) rather than MFA failure outright.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1398
- **ID:** TL-2026-1398
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sophos' 2026 threat-intelligence portfolio — the State of Ransomware 2026 survey, the Active Adversary Report 2026, and the State of Identity Security 2026 report — collectively documents a structural shift in ransomware initial-access patterns away from vulnerability exploitation and toward identity compromise.

In the State of Ransomware 2026 survey (2,158 IT/cybersecurity leaders across 17 countries, all from organizations hit by ransomware in the prior 12 months), the top reported root causes were malicious email (26%, up from 19% in 2025), phishing (24%, up from 18%), and compromised credentials (23%), while exploited vulnerabilities fell to 18% (from 32% in 2025) and brute-force attacks accounted for 6%. Combined, these identity-adjacent vectors mean 79% of ransomware attacks now start with an identity-based approach. Attackers most often entered through exposed applications/systems (38%), user devices (30%), firewalls (21%), VPNs (8%), and IoT devices (3%).

Critically, 97% of victims whose root cause was compromised credentials had MFA deployed in some form at the time of attack — but coverage was uneven: SaaS applications were commonly protected while VPNs, firewall admin consoles, and legacy/on-prem applications frequently were not. Sophos CISO Ross McKerchar warned that AI-assisted reconnaissance will let attackers "enumerate identity misconfigurations far more cheaply and quickly than before," widening this gap further.

The Active Adversary Report 2026 (661 incident-response/MDR cases across 70 countries and 34 industries) found 67% of incidents traced to identity-related weaknesses and MFA absent in 59% of those cases. Once inside, attackers reached Active Directory in a median of 3.4 hours, with overall median dwell time falling to 3 days (down year-over-year, reflecting both faster attacker tradecraft and faster defender response). Payload deployment (88%) and data exfiltration (79%) both occurred predominantly outside business hours, an evasion pattern that exploits reduced SOC staffing and, increasingly, thinner log retention: the report noted missing-log incidents (often due to 7-day or 24-hour firewall log retention defaults) doubled year-over-year. Sophos tracked 51 distinct ransomware brands (27 returning, 24 new) — the highest number of active groups in the report's history — with Akira (tracked as GOLD SAHARA) involved in 22% of incidents and only LockBit, MedusaLocker, Phobos, and BitLocker-abuse operations persisting continuously since 2020.

The companion State of Identity Security 2026 report (5,000 IT/security leaders, 17 countries, 14 industries) found 71% of organizations suffered at least one identity-related breach in the past 12 months (averaging three per affected organization), with Switzerland (89%) and Mexico (83%) hit hardest and the energy/oil/gas sector most exposed (80%). 67% of ransomware victims tied their attack directly to their most significant identity compromise. A major and emerging root cause is weak non-human identity (NHI) management — API keys, service accounts, and AI agents, which can outnumber human identities by ratios as high as 100:1 — implicated in 41% of successful identity breaches; only 34% of organizations regularly audit or rotate NHIs, and just 11.1% do so continuously. Organizations with weak NHI management saw 22% higher likelihood of financial theft and 24.4% higher likelihood of extortion, and averaged $147,178 higher recovery costs. Average identity-breach remediation cost was $1.64 million (median $750,000), with 73% of victims spending $250,000+ per incident.

On outcomes, 56% of ransomware attacks still succeeded in encrypting data despite these defenses; 48% of victims with encrypted data paid a ransom (roughly flat against the four-year average of 50%). Median ransom demands fell 65% over two years to $698,000, and median payments fell to $769,000 from $1 million previously, with 51% of paying organizations negotiating below the initial demand — a trend Sophos attributes to greater victim sophistication and broader availability of decryptors/backups rather than reduced attacker capability. Recovery-cost averages nonetheless rose 11% year-over-year to $1.7 million per incident, and backup-based recovery rose to 66% of encrypted-data cases (up 12 points), while 55% of organizations recovered within one week and 16% within a day. Payment behavior varied sharply by sector and geography: local/state government victims paid at the highest rate (72%) versus retail's lowest (32%), and the UK recorded the highest median ransom demand globally at $2.5 million. Smaller organizations (100-250 employees) detected and stopped attacks pre-encryption only 34% of the time versus 46% for mid-large organizations (3,001-5,000 employees), and were roughly twice as likely to miss identity attacks entirely versus organizations with 1,000+ employees.

Taken together, the three reports describe a maturing ransomware economy that has shifted its center of gravity from patching-cycle vulnerability exploitation to identity-perimeter exploitation — credential theft, phishing, MFA-coverage gaps, and unmanaged non-human identities — while ransom economics simultaneously compress (lower demands/payments) even as recovery costs and group proliferation increase.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1110 Brute Force
- T1556 Modify Authentication Process
- T1552 Unsecured Credentials
- T1098 Account Manipulation
- T1136 Create Account
- T1482 Domain Trust Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1070 Indicator Removal
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact

## Sources

- [Identity Attacks Overtake Exploits as Top Ransomware Cause](https://www.darkreading.com/identity-access-management-security/identity-attacks-overtake-exploits-top-ransomware-cause)
- [The State of Ransomware 2026: Payments Drop as Encryption Climbs](https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026)
- [Sophos Active Adversary Report 2026: Identity attacks dominate as threat groups proliferate](https://www.sophos.com/en-us/press/press-releases/sophos-active-adversary-report-2026-identity-attacks-dominate-as-threat-groups-proliferate)
- [Sophos State of Identity Security 2026](https://www.sophos.com/en-us/blog/sophos-state-of-identity-security-2026)
- [Over 70% of organizations hit by identity breaches](https://www.helpnetsecurity.com/2026/05/14/sophos-2026-identity-breach-costs-report/)
- [Identity-Related Breach Hit 71% of Enterprises, Sophos Survey Finds](https://www.cybersecurity-insiders.com/identity-related-breach-sophos-2026/)
- [79% of Ransomware Attacks Now Originate from Compromised Identities, Sophos Report Finds](https://www.manilatimes.net/2026/07/15/tmt-newswire/globenewswire/79-of-ransomware-attacks-now-originate-from-compromised-identities-sophos-report-finds/2384845)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1398