Stolen Credentials Now Drive the Majority of Ransomware Incidents

Cybercriminals have shifted tactics. A new analysis from Sophos shows that compromised logins are now the primary way ransomware gets inside a network. The report, based on real-world incidents, found that 79% of ransomware attacks trace back to an initial intrusion that exploited legitimate user credentials or abused identity systems.

That’s a major jump. It means the front door — a stolen password or a phished login — is now far more dangerous than a software bug.

“Over the last 12 months across the ransomware landscape we’ve seen attackers rely on ‘easier’ attacks, using compromised identities as the primary initial access vector,” said Ross McKerchar, CISO at Sophos, in a statement to Infosecurity. He pointed to advances in social engineering, including AI-polished phishing emails and sophisticated ClickFix campaigns designed to trick even trained users into bypassing multi-factor authentication (MFA).

How Attackers Get In: Phishing, Brute Force, and Old Vulnerabilities

The report breaks down the initial entry points. Malicious emails accounted for 26% of ransomware incidents, up from 19% in 2025. Phishing attacks — often used to steal credentials — were the root cause in 24% of cases, rising from 18% the previous year.

Brute force attacks came in third at 23%, a slight dip from 22% in 2025. That method relies on automation to guess weak or common passwords.

What’s falling out of favor? Exploiting known security vulnerabilities. That approach dropped from 32% in 2025 to just 18% in 2026. Attackers are choosing the path of least resistance — and that path leads straight to human error and weak identity controls.

Where Stolen Logins Are Used: VPNs, Firewalls, and IoT Devices

Once attackers have a valid login, they don’t stop at one system. The report details how exploited identities are used to move laterally. In 38% of cases, attackers accessed exposed applications or systems. Remote device logins accounted for 30%, firewalls for 21%, and exposed VPNs for 8%. Even IoT devices served as an initial point of entry in 3% of incidents.

That breadth of access points means a single compromised password can open multiple doors. No wonder identity-based attacks are surging.

Why Organizations Are Still Getting Caught Off Guard

Sophos surveyed 2,158 cybersecurity leaders. Their answers reveal persistent gaps. 62% cited security gaps in the network — both known and unknown — as a reason attacks went undetected. Over half (58%) said their organization was held back by a lack of people or expertise. And 57% felt they hadn’t implemented the right level of cybersecurity protections.

The message is clear: tools alone aren’t enough. Teams need the right skills and the right configurations to make identity-based defenses work.

Ransom Payments: Smaller Demands, But More Victims Paying

The report also tracks ransom demands. The median demand has fallen to $698,000, down from $2 million just two years ago. But that doesn’t mean attackers are getting softer. They’re tailoring demands to each victim. Smaller organizations get smaller asks. If the ransom seems “reasonable,” victims are more likely to pay — especially if they fear downtime will cost more than the ransom itself.

Among organizations that had data encrypted, 48% paid the ransom. Meanwhile, 66% used their own backups to restore some data, up from 54% in 2025. That’s progress, but it’s not a silver bullet.

How to Defend Against Identity-Based Ransomware Attacks

The Sophos report offers clear guidance: treat identity as a foundational security layer, not an afterthought. “Organizations should prioritize identity threat detection and response (ITDR), enforce multi-factor authentication across all access points, and regularly audit both human and non-human identity credentials,” the report recommends.

That means ransomware protection strategies must start with identity hygiene. Enforce MFA everywhere. Monitor for unusual login patterns. Audit credentials regularly. And don’t forget non-human identities — service accounts and API keys are often overlooked.

For readers looking to strengthen their defenses, a good place to start is understanding common phishing attack techniques and how to spot them. Training alone won’t stop every attack, but combined with strong identity controls, it raises the bar.

The bottom line? Attackers are going where the defenses are weakest — straight at the login screen. Organizations that lock that door first will have the best chance of keeping ransomware out.

Five Londoners Charged in ‘Russian Coms’ Vishing Probe

British police have charged five people from London in connection with a notorious fraud platform that enabled millions of scam calls. The suspects are accused of running and promoting National Crime Agency described as a cybercrime-as-a-service operation that tricked victims into handing over cash and personal data.

The charges include conspiracy to supply articles for fraud, money laundering, and failing to provide phone passcodes when ordered. All five are due to appear at Westminster Magistrates’ Court on August 14, 2026.

What Was Russian Coms?

Launched in 2020, Russian Coms started as a physical handset before evolving into a web-based app. Criminals used it to spoof caller IDs — making it look like they were dialing from banks, telecoms firms, or even law enforcement agencies.

“They allowed criminals to hide their identity by appearing to call from pre-selected numbers,” the NCA said in a statement. The goal was simple: convince victims their accounts were compromised and persuade them to transfer money to a “safe” account controlled by the scammers.

By the time the platform was shut down in 2024, it was linked to over 1.3 million scam calls targeting half a million UK phone numbers — plus many more overseas.

Who Are the Accused?

The five individuals charged are:

• Ayoub Sehailia, 28
• Zakkaria Sehailia, 30
• Usman Din, 30
• Denis Ozmus, 29
• Fadila Salem, 53

All are from different parts of London. Their court date is set for August 2026, more than two years away — a sign of the complexity of the case.

A Cybercrime-as-a-Service Empire

Russian Coms was marketed aggressively on Snapchat, Instagram, and Telegram. The package sold to fraudsters included “unlimited minutes,” “hold music,” encrypted calls, voice-changing tools, and 24/7 support.

The handset version came preloaded with VPN apps to hide the user’s IP address and a burner app that wiped the phone clean at the touch of a button. A six-month contract cost between £1,200 ($1,600) and £1,400 ($1,870), depending on delivery method.

Victims lost tens of millions of pounds, the NCA estimates. Fraud now accounts for 41% of all crime in the UK, with over two-thirds of it cyber-enabled.

Broader Crackdown on Fraud Gaining Ground

This case is part of a wider push by UK authorities. In January 2025, three men were sentenced at Snaresbrook Crown Court for running OTP.Agency, a site that helped fraudsters bypass multi-factor authentication (MFA) to hijack bank and telecom accounts.

More recently, Operation Henhouse 5 led to more than 500 arrests, freezing orders against £9 million ($12 million), and seizures of cash and assets worth £18.1 million ($24.3 million).

Still, the scale of the problem is daunting. The NCA says fraudsters are constantly adapting, using platforms like Russian Coms to stay one step ahead. The charges announced today are a reminder that law enforcement is catching up — but the fight is far from over.

Only a handful of FTSE 350 giants signed up

Fewer than 15 of Britain’s 350 largest listed companies put their names to the government’s flagship voluntary cybersecurity scheme at its launch on Tuesday. That’s despite ministers writing personal letters eight months ago to the chair and chief executive of every single FTSE 350 firm, urging them to join.

The UK Cyber Resilience Pledge was unveiled at a 10 Downing Street reception hosted by Technology Secretary Liz Kendall. In total, 70 founding signatories were named. But 20 of those are strategic government suppliers — companies that deliver critical services to the state and were invited to sign via a separate Government Cyber Charter. Strip them out, and the launch included just 50 truly voluntary signatories from across the wider economy.

Among the big names that did sign: Aviva, the London Stock Exchange Group, and Marks & Spencer — the latter lost hundreds of millions of pounds in a cyberattack last year. The rest of the list is heavy on small cybersecurity consultancies like C3IA Solutions, Grey Zone Services and Nexor, for whom the pledge aligns neatly with their own commercial offerings.

What the pledge actually asks

The pledge is light-touch by design. It asks signatories to do three things:

• Make cybersecurity a board-level responsibility
• Register for the NCSC’s free Early Warning service
• Take a risk-based approach to requiring Cyber Essentials certification across their supply chains

All of it is voluntary. There is no enforcement mechanism. The Department for Science, Innovation and Technology did not respond to questions about whether signing carries procurement consequences for strategic suppliers, nor whether it regarded the FTSE 350 turnout as a strong response to the ministerial letter.

Why so few? Experts weigh in

Jamie MacColl, a senior research fellow at the Royal United Services Institute, said the number of signatories struck him as low.

“I would be relatively surprised if most FTSE 350 companies were not meeting an equivalent standard. Why would they go through Cyber Essentials when in many cases they will have a certification that has many more controls in it?”

MacColl sees a familiar pattern. “I think the pattern with UK cyber policy is often a consultation, research, code of practice or conduct, some sort of voluntary pledge, and then regulation. This could be repeating that pattern.”

He added: “You could see this as a step in the process whereby they end up regulating. You’ve almost given the private sector enough rope to hang itself with. If not enough organizations or vendors sign up to this stuff, that gives the government the cause to say regulation is necessary.”

Timing and context

Tuesday’s launch had been planned to follow the unveiling of Britain’s new National Cyber Action Plan on Monday. That was delayed due to Prime Minister Keir Starmer’s resignation.

The launch comes amid wider scrutiny of the government’s appetite to compel industry to act on cybersecurity. It follows the NCSC complaining about organizations failing to follow its guidance and advice.

The government says it will keep reviewing the pledge. In its own words: “Given that the threat landscape is evolving and new complex cyber threats may emerge, government will continue to review the suitability of the pledge, with the potential of refining the actions at the end of a 12-month cycle.”

The cost of inaction

According to the government, “the average cost of a significant cyberattack on an individual UK business now stands at almost £195,000 ($260,000), with the annual cost to organizations estimated at £14.7 billion ($19.7 billion), excluding wider disruption across the economy.”

That £14.7 billion figure comes from research supporting a separate measure — the Cyber Security and Resilience Bill — which is still being debated in Parliament and is not expected to be enforced until 2028.

So for now, the message to Britain’s biggest companies is: you’re asked nicely. Whether that changes depends on how many more decide to sign up over the next 12 months.