Incidents & Breaches
Identity attacks surpass vulnerabilities as top ransomware cause
Phishing and malicious email now cause half of all ransomware attacks, according to a report surveying 1,200 IT and security professionals [2, 3].
Identity attacks and ransomware
Ransomware crews increasingly enter through identity systems rather than software flaws. This hub follows data linking credential and directory compromise to ransomware, and the detection tooling aimed at it.
Understand the story
Follow this story through dated reporting and the underlying records. Evidence labels distinguish documented findings, attributed reporting, disputed accounts and claims that remain unverified. Start with the background reports below, then read the latest developments.
Start with these reports
Check the evidence
Primary documents
Latest reporting
More on Identity attacks and ransomware
Incidents & Breaches
Attackers bypass MFA at 79 organizations using session token replay
Threat actors used stolen sign-in sessions to breach Microsoft 365 accounts, while a new report finds identity systems targeted in 87% of ransomware cases.
Incidents & Breaches
Identity attacks rise 32% as actors shift to bypassing MFA
Threat actors increasingly target session tokens and human behavior to circumvent multi-factor authentication, according to new industry analysis.
Analysis & Practice
Semperis report: Identity systems targeted in 87% of ransomware attacks
A Semperis report shows identity systems are targeted in 87% of ransomware attacks, highlighting critical gaps in hybrid architectures and recovery backups.