Ransomware Attacks Shift Tactics: Compromised Identities Now Dominant Entry Point — Sophos Limited

Event summary

79% of ransomware attacks now originate from compromised identities, up from previous years.
Malicious email (26%) and phishing (24%) have overtaken exploited vulnerabilities as the top initial access vectors.
56% of ransomware victims had their data encrypted, reversing a two-year downward trend.
The UK recorded the highest median ransom demand at $2.5 million.
Organizations are recovering faster post-attack, with 55% doing so within one week.

The big picture

Sophos' report highlights a strategic shift in ransomware tactics, with attackers increasingly leveraging compromised identities over exploited vulnerabilities. This evolution underscores the need for robust identity management and AI-driven defense strategies as organizations face rising recovery costs and more sophisticated threats. The cybersecurity landscape is adapting, but defenders must keep pace with both technological advancements and adversarial innovation.

What we're watching

AI-Driven Threats: How AI will accelerate attackers' ability to exploit identity misconfigurations and software vulnerabilities.
Defensive Strategies: Whether organizations can sustain improved recovery times amid evolving ransomware tactics.
Ransomware Economics: The pace at which median ransom demands and payment rates will continue to shift.