Ransomware has evolved. Crews now go after identity systems, administrative controls, backups and recovery infrastructure to stop victims from restoring operations. With 721 publicly disclosed victims recorded in June 2026 alone, the shift toward identity-first attacks is hard to miss.
If an attacker owns your Active Directory, they own your recovery too.
Our analysis
The move from “encrypt files” to “own identity and recovery” is the most important ransomware trend of 2026. Control Active Directory and you can disable backups, escalate everywhere and dictate terms — encryption becomes optional leverage rather than the whole attack. Any recovery plan that quietly assumes your identity provider survives an incident intact is now dangerously out of date.
What you should do
- Harden and tier Active Directory; close the common escalation paths (Kerberoasting, delegation abuse, dangerous ACLs).
- Keep offline, immutable backups and rehearse restoration without trusting production AD.
- Deploy identity threat detection and alert on mass privilege or GPO changes.
- Validate the whole chain with AD penetration testing, assumed-breach and red-team exercises.
How AgentOffense helps: our Active Directory penetration testing closes the escalation paths to domain admin, while an assumed breach assessment and red team operations test detection, response and recovery.
Source: Cybersecurity Insiders.
Why attackers go after identity, not files
Encrypting files is noisy and, with good backups, recoverable. Owning identity is quiet and total. Control Active Directory or your cloud identity provider and you can grant yourself access to everything, switch off defences, and push ransomware everywhere at once from a position of trust.
That is why modern intrusions race toward Domain Admin or global admin as the real objective. Kerberoasting, delegation abuse and privilege-escalation paths are the routes they take — and finding them first, from an assumed-breach starting point, is the only defence that reliably holds.
What this means for your business
Ransomware crews have shifted from encrypting files to owning identity, because control of Active Directory or your identity provider is control of everything. Identity is now the primary battleground.
How to reduce your exposure
- Harden Active Directory and cloud identity: tiered admin, no standing privileges, MFA everywhere.
- Hunt for Kerberoasting, delegation abuse and privilege-escalation paths to Domain Admin.
- Monitor identity systems for anomalous authentication and privilege changes.
- Test identity attack paths with an assumed-breach mindset.
Test your identity attack paths with Active Directory penetration testing and Entra ID security assessment — get a fixed-price quote.