Identity Attacks Drive Most Ransomware: Sophos Report
Identity attacks are root cause of 79% of ransomware incidents: Sophos
Related Entities(initial)
Organizations
Other
Full Report(when first published)
Executive Summary
Analysis of the 2026 Sophos "State of Ransomware" report reveals a fundamental shift in initial access vectors, with identity-based attacks now identified as the root cause in 79% of ransomware incidents. For the first time in four years, exploited vulnerabilities are not the top entry point. Instead, the leading causes are malicious email (T1566.001 - Spearphishing Attachment), phishing (T1566.002 - Spearphishing Link), and compromised credentials (T1078 - Valid Accounts). A critical finding is that in 97% of cases where compromised credentials were the cause, the victim organization had multi-factor authentication (MFA) deployed, suggesting attackers are routinely bypassing or evading these controls. This underscores the urgent need for organizations to move beyond basic MFA and adopt more advanced Identity Threat Detection and Response (ITDR) capabilities.
Threat Overview
- Primary Root Cause: Identity-based attacks (79% of incidents)
- Top Initial Access Vectors (IAVs):
- Malicious Email: 26%
- Phishing: 24%
- Compromised Credentials: 23%
- Key Finding: Exploited vulnerabilities are no longer the number one root cause.
- MFA Evasion: 97% of victims breached via compromised credentials had MFA in place.
This data indicates a clear strategic shift by attackers. Instead of searching for a rare zero-day, they are focusing on the much larger and more vulnerable human attack surface. Attackers are becoming more adept at social engineering and technical methods to steal credentials and bypass security controls designed to protect them.
Technical Analysis
Attackers are successfully bypassing MFA through several methods:
- MFA Fatigue / Push-Bombing: Attackers with a valid username and password repeatedly send MFA push notifications to the user's mobile device, hoping the user will eventually approve one by accident or out of frustration.
- Adversary-in-the-Middle (AiTM) Phishing: Sophisticated phishing kits are used to create a proxy between the victim and the real login page. The victim enters their credentials and MFA code into the fake site, which are then passed to the real site by the attacker, who captures the session cookie. This cookie allows the attacker to bypass MFA entirely.
- SIM Swapping: Attackers convince a mobile carrier to transfer a victim's phone number to a SIM card they control, allowing them to intercept SMS-based MFA codes.
The report highlights that defenders can no longer simply "set and forget" MFA. They must assume that determined attackers can find a way around it.
Impact Assessment
- Misallocated Defenses: The report suggests that many organizations are still overly focused on patching vulnerabilities (
M1051 - Update Software) while underinvesting in identity security. While patching is crucial, it is no longer sufficient on its own. - Increased Speed of Attack: Attackers using compromised credentials can move much faster than those who have to perform reconnaissance to find and exploit a vulnerability. This reduces the defender's time to detect and respond.
- Need for Advanced Controls: The failure of traditional MFA in 97% of credential-based breaches demonstrates that organizations must invest in stronger, phishing-resistant MFA (like FIDO2) and ITDR solutions that can detect anomalous identity behavior.
IOCs — Directly from Articles
This is a trend report and contains no specific IOCs.
Cyber Observables — Hunting Hints
To detect identity-based attacks and MFA bypass, hunt for:
log_source"MfaDetail": "MFA completed in session" followed by suspicious activity, or sign-ins from geographically impossible locations.event_id500121user_agentotherDetection & Response
- Identity Threat Detection and Response (ITDR): Deploy ITDR solutions that baseline normal user login behavior and alert on anomalies. This includes impossible travel, logins from unfamiliar devices or locations, and unusual privilege escalation. This is a direct application of D3-UGLPA: User Geolocation Logon Pattern Analysis.
- Monitor MFA Events: Actively monitor for MFA fatigue storms (multiple failed MFA attempts for one user) and alert the security team and the user.
- Session Monitoring: Monitor for session hijacking indicators, such as a session token being used from a different IP address or user-agent than the one it was issued to.
Mitigation
- Phishing-Resistant MFA: The most critical mitigation is to move away from phishable MFA methods like SMS and push notifications. Adopt phishing-resistant methods like FIDO2/WebAuthn security keys. This is an advanced form of D3-MFA: Multi-factor Authentication.
- User Training: While not a panacea, continuous user training on how to spot sophisticated phishing attacks and the dangers of MFA fatigue is still essential. This falls under M1017 - User Training.
- Credential Hardening: Enforce strong password policies, eliminate password reuse, and use credential protection features like Windows Defender Credential Guard.
- Reduce Attack Surface: As recommended by Sophos CISO Ross McKerchar, organizations must focus on reducing their external attack surface to limit the initial entry points for attackers.
Timeline of Events
Article Updates
August 6, 2026
Greatness PhaaS now offers device code phishing, a new AiTM technique abusing OAuth 2.0 to bypass MFA and steal Microsoft 365 tokens.
Update Sources:
MITRE ATT&CK Mitigations
Multi-factor Authentication
The report stresses the need for stronger, phishing-resistant MFA (like FIDO2) over traditional, bypassable methods.
Mapped D3FEND Techniques:
User Training
Training users to recognize sophisticated phishing and social engineering attacks is crucial to defend against identity-based threats.
Behavior Prevention on Endpoint
Implementing Identity Threat Detection and Response (ITDR) to analyze user behavior and detect anomalies is key to spotting compromised identities.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The Sophos report's most critical takeaway is that not all MFA is created equal. To counter the trend of MFA bypass, organizations must evolve their D3-MFA (Multi-factor Authentication) strategy. The immediate priority should be to migrate away from phishable MFA methods like SMS and simple push notifications. Instead, organizations must adopt phishing-resistant authenticators, with FIDO2/WebAuthn (using hardware security keys like YubiKeys or platform authenticators like Windows Hello) being the gold standard. This method binds the authentication to the hardware and the origin domain, making it immune to credential theft via adversary-in-the-middle (AiTM) phishing attacks. For services where FIDO2 is not supported, use number matching or other context-aware push notifications as an interim improvement. The finding that 97% of credential breach victims had MFA shows that simply having an MFA checkbox ticked is no longer a valid defense.
Since attackers are successfully bypassing preventative controls like MFA, detection becomes paramount. Organizations need to implement D3-UBA (User Behavior Analysis) through an Identity Threat Detection and Response (ITDR) solution. This involves creating a baseline of normal activity for every user account and alerting on deviations. Key patterns to monitor include: 'impossible travel' logins, access from new or unrecognized devices, unusual frequency of access, and privilege escalations. For example, if a user's account, which has never been used for administrative tasks, suddenly attempts to add a new user to a privileged group, this should trigger a high-severity alert and potentially an automated response, like account suspension. By analyzing behavior patterns, security teams can detect a compromised identity even if the attacker has valid credentials and has bypassed MFA, providing a crucial layer of defense against modern identity-based attacks.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.