Threat video1:00
Sophos State of Ransomware 2026: Detection & IOCs
Sophos' 177-leader survey finds 85% of financial-services ransomware began with identity attacks; 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Sophos State of Ransomware 2026: Detection & IOCs →
Chapters
- 0:00The hook85% of ransomware began with identity.
- 0:04The storyCredentials, email, and phishing dominated initial attacks.
- 0:12Attack pathMalicious email and phishing initiated attacks.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to credential access.
- 0:42Remediation4 steps now: Review identity-based attack paths.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0085% of ransomware began with identity.
0:05Credentials, email, and phishing dominated initial attacks.
0:09Median payment $1 million.
0:13Malicious email and phishing initiated attacks.
0:16Compromised credentials enabled privilege escalation.
0:20Ransomware then encrypted 59% of systems.
0:27No threat actor is attributed. Confidence: low.
0:32No malicious indicators were published.
0:384 ATT&CK techniques, from initial access to credential access.
0:434 steps now: Review identity-based attack paths.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.