# AI Used in 84% of Ransomware Attacks as Identity Infrastructure (Active Directory, Entra ID, Okta) Comes Under Fire - Semperis 2026 Ransomware Risk Report

> Semperis' 2026 Ransomware Risk Report (1,200 IT/security professionals at organizations hit by ransomware in the past 12 months, nine countries, eight sectors) reports AI involvement in 84% of attacks and targeting or exploitation of identity systems in 87%. Repeat victimization (about 70%), ransom payment (59% paid at least once) and physical/psychological pressure on staff are also reported.

- **Published:** 2026-10-15T09:01:48Z
- **Last reviewed:** 2026-10-15T09:01:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3598
- **ID:** TL-2026-3598
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a trend-level assessment based on survey data, not a single campaign, CVE or malware family. Semperis surveyed 1,200 IT and security professionals across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia, covering eight industry sectors. Only organizations victimized by successful, business-disrupting ransomware attacks in the past 12 months were included, so the figures describe victims rather than the general population, and AI involvement is victim-reported rather than forensically verified. The report was published on 2026-10-14 and was covered by CBS News, GBHackers and others.

AI involvement: 84% of surveyed victims reported that attackers used AI in the attacks they experienced. Reported uses are identifying network weaknesses, tailoring social engineering to specific employees, automating intrusions and adjusting tactics during defensive response (the framing quoted from Chris Inglis, former U.S. National Cyber Director and Semperis strategic advisor), developing malicious code with reduced development time (including using large language models to test encryption implementations, per Semperis researcher Tomer Bar), and lowering the technical barrier for less experienced criminals. 44% reported attackers exploiting their own AI systems or agents. Semperis crisis-management lead Courtney Guss cautioned that task-driven AI agents seeking additional permissions can expose identity systems to unintended compromise, and Bar warned that AI complicates law-enforcement attribution. 49% said they used AI successfully for detection or response, while 23% said defensive AI tools failed.

Identity infrastructure: 87% of respondents reported attacks that targeted or exploited identity systems; the Semperis press release states nearly 75% of successful attacks did so. Active Directory was affected in 51% of cases, Microsoft Entra ID in 48% and Okta in 27%. Recovery readiness lags: only about 50% keep dedicated identity backups, 42% have automated identity recovery, and documented recovery procedures exist for Active Directory (60%), Entra ID (52%) and Okta (28%). Semperis recommends prioritizing secure identity restoration before operational recovery.

Extortion pressure: about 69-70% of victims were attacked successfully more than once, 59% paid at least once and 31% made multiple payments. 40% of attacks involved psychological or physical threats against staff; 53% of victims said attackers followed through on threats, 24% reported swatting of victims or family members, 25% sought psychological or medical treatment, 24% hired personal security and 14% said employees changed jobs or locations.

Limitations: no specific ransomware family, threat actor, CVE or network/file IOC is named in the sources, so none are recorded. The full Semperis PDF could not be machine-parsed; figures come from the vendor press release plus secondary coverage, and minor discrepancies exist between outlets (for example 69% vs 70% repeat victimization, and 33%/37%/40% for threats against staff or their families). Vendor-run surveys carry self-report and selection bias.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.001 Develop Capabilities: Malware
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1566 Phishing
- T1598 Phishing for Information
- T1078 Valid Accounts
- T1078.002 Valid Accounts: Domain Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1657 Financial Theft

## Sources

- [Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families](https://www.semperis.com/press-release/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families/)
- [Semperis Ransomware Risk Report (PDF)](https://www.semperis.com/wp-content/uploads/resources-pdfs/reports/resources-semperis-ransomware-risk-report.pdf)
- [AI linked to 84% of ransomware attacks, new report finds - CBS News](https://www.cbsnews.com/news/ai-linked-ransomeware-attacks-global-cybersecurity-report/)
- [AI Used in 84% of Ransomware Attacks as Identity Infrastructure Comes Under Fire - GBHackers](https://gbhackers.com/ai-powered-ransomware-attacks/)
- [Semperis 2026 Ransomware Report (PR Newswire release)](http://www.prnewswire.com/news-releases/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families-302907731.html)
- [Ransomware trends: increases seen in AI-driven attacks and physical threats against employees and their families - Resilience Forward](https://resilienceforward.com/ransomware-trends-increases-seen-in-ai-driven-attacks-and-physical-threats-against-employees-and-their-families/)
- [Ransomware Attacks Target Identity Systems as AI Exploitation and Personal Threats Escalate - Cyberpress](https://cyberpress.org/ransomware-attacks-target-identity-systems-as-ai-exploitation-and-personal-threats-escalate/)
- [Semperis survey finds repeat ransomware attacks hit nearly 70% of victims - RuntimeWire](https://runtimewire.com/article/semperis-ransomware-report-ai-identity-threats)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3598