Threat reportRansomwareTL-2026-3598
AI Used in 84% of Ransomware Attacks as Identity Infrastructure (Active Directory, Entra ID, Okta) Comes Under Fire - Semperis 2026 Ransomware Risk Report
AI Used in 84% of Ransomware Attacks as Identity (TL-2026-3598), also tracked as Semperis 2026 Ransomware Risk Report, is a medium-severity ransomware operation, first published 2026-10-15. It has no confirmed attribution, affects Microsoft Active Directory, maps to 9 MITRE ATT&CK techniques (T1078, T1078.002, T1078.004), and is covered by 9 detection rules and 6 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3598
- Threat ID
- TL-2026-3598
- Also known as
- Semperis 2026 Ransomware Risk Report
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all-sectors, enterprise
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in AI Used in 84% of Ransomware Attacks as Identity
Malware and tooling: Survey, Unnamed ransomware (multiple families, AI-assisted)
How AI Used in 84% of Ransomware Attacks as Identity works
Semperis' 2026 Ransomware Risk Report (1,200 IT/security professionals at organizations hit by ransomware in the past 12 months, nine countries, eight sectors) reports AI involvement in 84% of attacks and targeting or exploitation of identity systems in 87%. Repeat victimization (about 70%), ransom payment (59% paid at least once) and physical/psychological pressure on staff are also reported.
This is a trend-level assessment based on survey data, not a single campaign, CVE or malware family. Semperis surveyed 1,200 IT and security professionals across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia, covering eight industry sectors. Only organizations victimized by successful, business-disrupting ransomware attacks in the past 12 months were included, so the figures describe victims rather than the general population, and AI involvement is victim-reported rather than forensically verified. The report was published on 2026-10-14 and was covered by CBS News, GBHackers and others.
AI involvement: 84% of surveyed victims reported that attackers used AI in the attacks they experienced. Reported uses are identifying network weaknesses, tailoring social engineering to specific employees, automating intrusions and adjusting tactics during defensive response (the framing quoted from Chris Inglis, former U.S. National Cyber Director and Semperis strategic advisor), developing malicious code with reduced development time (including using large language models to test encryption implementations, per Semperis researcher Tomer Bar), and lowering the technical barrier for less experienced criminals. 44% reported attackers exploiting their own AI systems or agents. Semperis crisis-management lead Courtney Guss cautioned that task-driven AI agents seeking additional permissions can expose identity systems to unintended compromise, and Bar warned that AI complicates law-enforcement attribution. 49% said they used AI successfully for detection or response, while 23% said defensive AI tools failed.
Identity infrastructure: 87% of respondents reported attacks that targeted or exploited identity systems; the Semperis press release states nearly 75% of successful attacks did so. Active Directory was affected in 51% of cases, Microsoft Entra ID in 48% and Okta in 27%. Recovery readiness lags: only about 50% keep dedicated identity backups, 42% have automated identity recovery, and documented recovery procedures exist for Active Directory (60%), Entra ID (52%) and Okta (28%). Semperis recommends prioritizing secure identity restoration before operational recovery.
Extortion pressure: about 69-70% of victims were attacked successfully more than once, 59% paid at least once and 31% made multiple payments. 40% of attacks involved psychological or physical threats against staff; 53% of victims said attackers followed through on threats, 24% reported swatting of victims or family members, 25% sought psychological or medical treatment, 24% hired personal security and 14% said employees changed jobs or locations.
Limitations: no specific ransomware family, threat actor, CVE or network/file IOC is named in the sources, so none are recorded. The full Semperis PDF could not be machine-parsed; figures come from the vendor press release plus secondary coverage, and minor discrepancies exist between outlets (for example 69% vs 70% repeat victimization, and 33%/37%/40% for threats against staff or their families). Vendor-run surveys carry self-report and selection bias.
MITRE ATT&CK techniques used in TL-2026-3598
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
T1078.002 Valid Accounts: Domain Accounts
Privilege Escalation
T1078.004 Valid Accounts: Cloud Accounts
Resource Development
T1587.001 Develop Capabilities: Malware; T1588.007 Obtain Capabilities: Artificial Intelligence
Reconnaissance
T1595.002 Vulnerability Scanning; T1598 Phishing for Information
Impact
Affected products and versions in AI Used in 84% of Ransomware Attacks as Identity
Remediation for AI Used in 84% of Ransomware Attacks as Identity
Immediate actions
- Restrict agentic AI and automation service accounts from access to identity infrastructure (Active Directory, Entra ID, Okta)
- Verify that dedicated, isolated backups of Active Directory, Entra ID and Okta configuration exist and are current
- Review privileged identity changes and new permission grants for unexpected activity
- Alert on permission grants or role assignments made by AI agents or service principals
Longer-term hardening
- Document and rehearse identity-specific recovery procedures for Active Directory, Entra ID and Okta
- Deploy automated identity recovery capability
- Prioritize secure identity restoration before operational recovery in incident response plans
- Rehearse coordinated crisis response including support for staff targeted by threats and swatting
- Evaluate defensive AI tooling for failure modes before relying on it
Timeline of AI Used in 84% of Ransomware Attacks as Identity
- Approximate start of the 12-month window during which surveyed organizations were victimized by ransomware (derived from the report's 'past 12 months' criterion and the 2026-10-14 publication date)
- Report discloses identity recovery readiness gaps: ~50% keep dedicated identity backups, 42% automate identity recovery, Okta recovery procedures documented by only 28%
- CBS News reports the findings, including AI use for weakness identification, tailored social engineering, automated intrusion and LLM-assisted malicious code, with commentary from Chris Inglis
- Semperis press release (also distributed via PR Newswire) highlights AI-driven attacks, nearly 75% of successful attacks exploiting identity systems, and physical threats against executives and their families
- Semperis publishes its 2026 Ransomware Risk Report (1,200 respondents, nine countries, eight sectors): AI involved in 84% of attacks, identity systems targeted in 87%
- Threat tracked by Threadlinqs as a trend-level ransomware/identity-targeting item
- GBHackers publishes an article on the survey results, including Active Directory (51%), Entra ID (48%) and Okta (27%) impact figures and the caveat that AI involvement is victim-reported
Sources cited for AI Used in 84% of Ransomware Attacks as Identity
- Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families
- Semperis Ransomware Risk Report (PDF)
- AI linked to 84% of ransomware attacks, new report finds - CBS News
- AI Used in 84% of Ransomware Attacks as Identity Infrastructure Comes Under Fire - GBHackers
- Semperis 2026 Ransomware Report (PR Newswire release)
- Ransomware trends: increases seen in AI-driven attacks and physical threats against employees and their families - Resilience Forward
- Ransomware Attacks Target Identity Systems as AI Exploitation and Personal Threats Escalate - Cyberpress
- Semperis survey finds repeat ransomware attacks hit nearly 70% of victims - RuntimeWire
Detection coverage for TL-2026-3598
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3598 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.