Identity Infrastructure Becomes the Primary Ransomware Battleground

The ransomware landscape has undergone a fundamental transformation in 2026, shifting from traditional data encryption toward systematic exploitation of identity systems. According to the Semperis 2026 Ransomware Risk Report released today, a staggering 87% of ransomware attacks now target identity infrastructure such as Active Directory, Entra ID, and Okta. This pivot represents the most significant tactical change in the extortion economy since the advent of double extortion tactics, and it exposes a critical gap in organizational preparedness.

The Identity Crisis at the Heart of Ransomware

Identity systems have become the crown jewels for ransomware operators. These platforms control access to every resource in an organization, making them irresistible targets. Attackers who compromise Active Directory or cloud identity providers gain the ability to move laterally, escalate privileges, and exfiltrate data at unprecedented scale. The Semperis report, which surveyed 1,200 IT and security professionals across nine countries, reveals that nearly 75% of successful ransomware attacks specifically targeted or exploited the identity system.

Despite this concentration of risk, organizations remain dangerously unprepared:

• Only 50% of companies maintain dedicated identity backup systems
• Less than half automate identity system recovery
• 60% of disaster recovery plans do not include procedures for identity system recovery
• Nearly 70% of ransomware victims were targeted multiple times within a year

AI Weaponization Reaches Critical Mass

The integration of artificial intelligence into ransomware operations has reached a tipping point. In 84% of attacks surveyed, threat actors weaponized AI to enhance their capabilities. This includes using machine learning to identify network weaknesses, automate intrusion steps, and tailor social engineering schemes to specific employees with alarming precision.

Perhaps more concerning is the finding that 44% of surveyed victims experienced ransomware attacks that exploited their own AI agents or systems. As organizations race to integrate AI into their networks, they inadvertently create new attack surfaces. Autonomous AI agents can request additional permissions, interact with sensitive corporate systems, and introduce security risks that traditional defenses were never designed to address.

Chris Inglis, former White House National Cyber Director, described AI as an inflection point in cybercriminal capabilities. He warned that autonomous ransomware attacks, where machines conduct the entire attack chain without human intervention, are already operational.

The Escalation of Physical and Psychological Threats

Ransomware has evolved beyond digital extortion into something far more personal and threatening. The Semperis report documents a disturbing trend of physical and psychological intimidation tactics:

• 40% of attacks involved psychological or physical threats against staff
• In 53% of cases where threats were made, attackers followed through
• 24% of victims or family members were swatted
• 25% of victims sought psychological and medical treatment
• 14% of organizations had employees forced to change jobs, office locations, or residences

These tactics represent a deliberate escalation designed to increase pressure on victims to pay. When encryption fails to compel payment, attackers are turning to intimidation that extends beyond the corporate network into the personal lives of employees and their families.

Scale and Acceleration in Q3 2026

The Guidepoint Research and Intelligence Team reported that Q3 2026 saw 2,760 victims claimed by 112 distinct threat actors across 29 industries and 115 countries. This represents a 21.1% quarter-over-quarter increase in total victims and a 23.1% rise in active threat actors. Year-over-year comparisons are even more stark, with victim counts surging 75.3% compared to Q3 2025.

The ransomware ecosystem has also diversified structurally. The_Gentlemen and Qilin emerged as the most prolific cartels, collectively accounting for nearly 25% of all documented intrusions. Meanwhile, legacy operations like LockBit have contracted significantly, logging only 17 victims in the past month compared to their historical dominance. New entrants such as n0n and Lamashtu appeared with no prior track record, signaling coordinated multi-operator launches or structural spin-offs from dismantled cartels.

The Payment Paradox

One of the most counterintuitive findings is that while fewer victims are paying ransoms, the overall threat continues to accelerate. Chainalysis reported that total ransomware payments fell 8% year-over-year to $820 million in 2025, and the Verizon DBIR noted that 69% of victims refused to pay. Yet attack volumes keep climbing.

The explanation lies in the collapsing cost of conducting attacks. Traditional ransomware is being replaced by pure data extortion models where operational costs approach zero. Zscaler reported that data theft volumes surged 275% year-over-year, reaching nearly 900 terabytes of exfiltrated data. When attacks cost almost nothing to execute, even a lower expected payout per victim generates meaningful returns at scale.

Furthermore, while payment rates have declined, the amounts paid by those who do pay tell a different story. The median ransom payment rose 368% year-over-year, from $12,738 in 2024 to $59,556 in 2025. Among organizations that paid in Q3 2026, the average payment rose 34% to $321,000.

Defensive Imperatives for Organizations

The reports converge on several critical recommendations for organizations seeking to defend against the evolved ransomware threat:

Prioritize Identity System Protection

Organizations must treat identity infrastructure with the same criticality as their most sensitive data. This means implementing dedicated identity backups, automated recovery procedures, and identity-specific crisis response protocols. Active Directory, Entra ID, and Okta should be monitored continuously for signs of compromise.

Close the Detection-to-Containment Gap

The fundamentals of security have not changed, even as attackers have gotten faster. Patch velocity, identity hygiene, and response automation remain the controls that matter most. Organizations that minimize the time between detection and containment will outpace faster adversaries.

Secure AI Deployments

As AI agents become embedded in corporate environments, organizations must implement strict permission boundaries, monitor agent behavior for anomalous activity, and ensure that AI systems cannot be weaponized by attackers to escalate privileges or access sensitive data.

Prepare for Physical Threats

Crisis response plans must now account for physical and psychological threats against employees. This includes coordination with law enforcement, executive protection protocols, and support resources for affected staff and their families.

Conclusion

The ransomware threat of 2026 bears little resemblance to the encryption-focused attacks of just a few years ago. Today’s attackers leverage AI, target identity systems, and employ physical intimidation in a multi-dimensional assault on organizational resilience. The paradox of declining payment rates alongside surging attack volumes suggests that the extortion economy has reached industrial scale, where volume compensates for lower per-victim yields. For defenders, the message is clear: the controls that matter have not changed, but the speed and sophistication of the adversary demand unprecedented urgency in implementation. Organizations that delay identity system hardening, AI security governance, and response automation will find themselves in an increasingly narrow margin for error.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous