The Shift From Vulnerabilities to Identities
Sophos’s 2026 State of Ransomware report documents a significant shift in attacker methodology: 79% of ransomware attacks now originate from compromised identities rather than exploited vulnerabilities. Malicious email (26%) and phishing (24%) have overtaken vulnerability exploitation as the primary initial access vectors.
This represents a tactical evolution. Attackers have recognized that stealing credentials or tricking users into running malicious attachments is often easier and faster than finding and exploiting software vulnerabilities. The report notes that 97% of incidents involving compromised credentials occurred in environments where multi-factor authentication was deployed “in some capacity” — meaning MFA coverage gaps or implementation weaknesses allowed the attacks to succeed.
For defenders, this creates an uncomfortable reality: you can patch every system, deploy MFA everywhere, and train users on phishing recognition, and attackers will still find a way in. A single user clicking a malicious link, a single service account with a weak password, a single MFA bypass technique — and the attacker has valid credentials to your environment.
What Credential Compromise Doesn’t Change
Here’s what the shift to credential-based attacks doesn’t change: ransomware still has to interact with your file system.
The attack sequence looks like this:
- Attacker compromises credentials via phishing or password spray
- Attacker authenticates using those valid credentials
- Attacker delivers ransomware payload — this requires writing an executable file to disk
- Payload executes and begins encryption — this requires writing encrypted versions of files and deleting originals
Steps 3 and 4 are file system operations. They happen regardless of whether the attacker exploited a vulnerability or stole a password. And they happen on Windows systems, which means they pass through the file system filter driver stack where FileSure Defend operates.
FileSure doesn’t try to determine whether the user account is compromised. It doesn’t analyze authentication events or monitor for credential misuse. It simply enforces file operation policies at the kernel level: which programs are allowed to create executable files, which programs are allowed to write to specific file types, which programs are allowed to perform bulk file operations.
When a user clicks a phishing link and Outlook.exe or Chrome.exe attempts to write an executable payload to disk, that’s a file create operation by a program that shouldn’t be creating executables. FileSure’s “Watch for phishing malware” rule detects exactly this scenario — trusted applications like email clients and browsers writing suspicious files. The operation is blocked before the payload lands.
If the attacker somehow gets a payload onto the system and it attempts to encrypt files, that’s thousands of file write operations by an unauthorized program. FileSure blocks those writes. The ransomware can’t encrypt files it can’t write to.
The Rule Configuration
A basic FileSure policy that addresses credential-based ransomware delivery:
Rule: Block Executable Delivery via Email/Browser
- File name filter:
*.exe, *.dll, *.scr, *.bat, *.cmd, *.ps1 - Program name filter:
outlook.exe, chrome.exe, firefox.exe, msedge.exe, iexplore.exe - Operations:
Create, Write - Action:
Block and Alert
Rule: Block Unauthorized Encryption Activity
- File name filter:
*.docx, *.xlsx, *.pdf, *.jpg, *.png(your critical file types) - Program name filter:
*(all programs except explicitly authorized) - Operations:
Write, Delete, Rename - Threshold:
100 operations in 60 seconds - Action:
Block and Alert
The first rule stops the payload from landing. The second rule stops encryption even if the payload somehow executes. Both rules work regardless of whether the attacker has valid credentials, because they operate at a layer below user authentication — at the file system operation layer.
The Sophos report makes clear that organizations have improved at recovery — 55% now recover within one week, and negotiation success rates have improved. But recovery still costs an average of $1.7 million per incident. Prevention at the file system layer, before encryption occurs, eliminates that cost entirely.
Start a free 21-day trial of FileSure Defend at bystorm.com and see it block a simulated ransomware payload in under three minutes.
Source: 79% of Ransomware Attacks Now Originate from Compromised Identities, Sophos Report Finds
Category: Ransomware
Tags: credential compromise, phishing, identity-based attacks, file system security, kernel filter driver, ransomware prevention, sophos report
