Ransomware attackers now break in mainly by stealing and abusing legitimate logins, not by exploiting software flaws. In the Sophos State of Ransomware 2026 survey of 2,158 IT and security leaders whose organizations were hit, 79% of attacks started with an identity-based approach — compromised credentials, session hijacking, or social engineering. Identity compromise means an attacker uses valid account access rather than a technical exploit to get in. This shift matters because your defenses may be tuned for the wrong threat, and because most victims already had multi-factor authentication (MFA) turned on when they were breached.
Table of Contents
- What "identity-first" ransomware actually means
- How strong is the evidence for a shift?
- Why MFA is not stopping this
- Speed changes your response window
- What defenders should prioritize
- Frequently Asked Questions
What "identity-first" ransomware actually means
An identity-based attack uses real account credentials — usernames, passwords, or active login sessions — instead of a code vulnerability. The attacker logs in like a legitimate user, so traffic often looks normal to security tools. Sophos ties this directly to outcomes: 67% of victims said their ransomware incident was the same event as their most significant identity attack, per Sophos's 2026 findings.
In other words, the stolen login and the ransomware are usually one connected intrusion, not two separate problems. The practical takeaway is that a compromised account is now a likely first step toward encryption or extortion. Treating credential theft as a minor event underestimates where it can lead.
How strong is the evidence for a shift?
The trend shows up across independent sources, though the strength varies. Sophos reports the clearest "identity over exploits" signal: attacks starting from exploiting known vulnerabilities fell to 18%, while malicious email (~26%) and phishing (~24%) rose, according to Security Magazine's reporting on the findings. Palo Alto Networks' Unit 42 data is more measured.
Its Global Incident Response Report 2026, built from 750+ investigations, found 65% of initial access was identity-driven and that identity weaknesses played a role in nearly 90% of cases. But among specific techniques, phishing and vulnerability exploitation were tied at 22% each. So the honest reading is nuance: identity is clearly rising and often dominant, but exploits have not disappeared. Cisco Talos adds corroboration, reporting in its IR Trends Q1 2026 that phishing reemerged as the top initial-access vector.
Why MFA is not stopping this
The uncomfortable finding is that MFA was already in place for most victims. Sophos reports that 97% of victims whose root cause was compromised credentials had some form of MFA enabled, yet gaps persisted on VPNs, firewall admin consoles, and legacy applications. Attackers increasingly bypass MFA by stealing active session cookies — the tokens that keep you logged in after you authenticate.
Recorded Future's March 2026 identity report indexed 276 million active session cookies, 31% of malware-sourced credentials, and found roughly 87 stolen credentials per infected device. That means an infostealer infection on one laptop can hand attackers dozens of working logins and ready-made sessions. If a stolen cookie is still valid, the attacker skips the login prompt entirely — MFA never triggers.
Speed changes your response window
Once inside, attackers move fast. Unit 42 found the fastest 25% of intrusions reached data exfiltration in about 72 minutes, with attackers using automation to accelerate reconnaissance and social engineering. A 72-minute path from access to data theft leaves little room for manual triage.
Detection that relies on catching an intrusion overnight or reviewing alerts the next morning is too slow for the fastest cases. This speed reinforces the identity angle: if the entry point is a valid login, there is no malware signature or exploit alert to catch early. Defenders need to spot anomalous account behavior quickly, not just block known bad files.
What defenders should prioritize
Because most victims already had MFA, "we have MFA" is not a finish line. Focus on the gaps attackers are actually using. For a full breakdown of the underlying data, defenders can read the Sophos State of Ransomware 2026 report directly and compare its numbers against their own environment.
- Deploy phishing-resistant MFA (such as passkeys or hardware security keys) for high-value accounts, not just app-based codes.
- Protect session tokens and cookies, and shorten session lifetimes so stolen sessions expire faster.
- Close MFA gaps on VPNs, firewall admin consoles, and legacy apps, where Sophos found coverage often missing.
- Treat any infostealer infection as a credential breach: reset passwords and revoke active sessions for that device's users.
- Monitor for anomalous logins and privilege use, since a valid-credential intrusion may leave no exploit alert.
Frequently Asked Questions
Does this mean exploits no longer matter for ransomware?
No. Unit 42's 2026 data shows vulnerability exploitation still tied with phishing at 22% of initial-access techniques, so patching remains essential alongside identity defenses.
If we already require MFA, are we protected?
Not fully. Sophos found 97% of credential-root-cause victims had MFA, with attackers bypassing it through stolen session cookies and gaps on VPNs and legacy apps.
Why are session cookies such a big risk?
A valid session cookie keeps a user logged in, so a thief who steals it skips the login and MFA prompt entirely. Recorded Future indexed 276 million active session cookies.