How FileSure Would Have Stopped the Credential-Based Ransomware Attacks Described in Sophos’ 2026 Report

The Problem: Ransomware No Longer Breaks In. It Logs In.

Sophos’ seventh annual State of Ransomware report, released in July 2026, documents a fundamental shift in how ransomware attacks begin. For the first time in years, exploited software vulnerabilities are no longer the leading cause. Instead, 79% of ransomware attacks now start with a compromised identity — a stolen password, a hijacked session, or credentials purchased from a criminal marketplace.

The report surveyed 2,158 IT and cybersecurity leaders across 17 countries whose organizations had been hit by ransomware in the past year. The findings are blunt: phishing (24%) and malicious email (26%) have overtaken exploited vulnerabilities (18%) as the most common entry points. Two-thirds of victims said their ransomware incident and their most significant identity attack were the same event.

Here’s the part that should worry anyone who treats MFA as a solved problem: 97% of incidents involving stolen credentials affected organizations that already had multi-factor authentication enabled. The methods attackers use to bypass MFA keep changing, and coverage tends to have more gaps than IT teams assume.

So you turn on MFA. You patch your systems. You train your users not to click suspicious links. And the attacker still gets in. What happens next?

Why Authentication Alone Isn’t Enough

Once an attacker has valid credentials — whether they phished them, bought them, or bypassed your MFA — they still need to accomplish something. In nearly every ransomware case, that “something” involves writing an executable payload to disk.

Ransomware doesn’t encrypt files by telepathy. It has to:

1. Deliver a payload (usually via email attachment, browser download, or remote session)
2. Write that payload to the Windows file system
3. Execute the payload
4. Write encrypted versions of your files back to disk

Steps 2, 3 and 4 are file system operations. They happen at the kernel level, regardless of how the attacker authenticated or which application they’re using as a delivery vector.

This is where FileSure Defend applies. It doesn’t try to stop the phishing email or detect the stolen credentials. It operates one layer deeper: at the file system operation layer, before the payload ever lands on disk.

How FileSure’s Kernel-Level Blocking Would Have Prevented These Attacks

FileSure Defend runs as a Windows kernel filter driver. It intercepts every file operation — open, read, write, create, delete, rename — before the operation completes. You define rules that specify which users, programs, and machines are allowed to perform which file operations.

Here’s a rule configuration that would have stopped the attacks described in the Sophos report:

Rule: Block Executable Payload Delivery

• File name filter: *.exe, *.dll, *.scr, *.bat, *.ps1, *.vbs, *.js
• Program name filter: outlook.exe, chrome.exe, firefox.exe, msedge.exe, mstsc.exe, iexplore.exe
• Operations: Create, Read, Write
• Drive type: Local Fixed Disk
• Action: Block

This rule prevents email clients, web browsers, and remote desktop clients from writing executable files to local disk. Those programs have no legitimate reason to create .exe or .dll files. If a phishing email delivers a malicious attachment, or if an attacker with stolen RDP credentials tries to drop a payload via remote session, the write operation is blocked at the kernel level. The payload never lands. It never executes. Your files are never encrypted.

The attacker might have valid credentials. They might have bypassed your MFA. But they can’t accomplish their objective, because they can’t write the ransomware to your file system.

FileSure doesn’t need to recognize the ransomware variant. It doesn’t rely on signatures or threat intelligence feeds. It simply enforces the rule: these programs are not authorized to perform this operation. Done.

What This Means for Organizations Still Treating Ransomware as an Authentication Problem

The Sophos report shows that backup-based recovery rose to 66% of encrypted-data cases, up from 54% the prior year. That’s good news — organizations are investing in tested, offline backups. But recovery still takes time, causes operational disruption, and often results in leadership changes (more than one in five victims said their IT or security leadership was replaced after the attack).

Prevention is better than recovery. And prevention at the file system layer is more durable than prevention at the authentication layer, because it doesn’t depend on users making perfect decisions under pressure or MFA implementations having zero gaps.

FileSure Defend protects the same way whether the attacker phished their way in this morning or exploited a vulnerability five years ago. It works offline, it works on legacy Windows systems that modern endpoint tools won’t touch, and it works on ransomware variants that nobody has seen before.

You can test it yourself in under three minutes. Install FileSure on a test machine, enable the pre-configured ransomware protection rules, and try to save an executable file from Outlook or Chrome. Watch the write get blocked and logged in real time. That’s the whole demo. It works exactly like that, every time.

Start your free 21-day trial at bystorm.com. No credit card required.

---

Source: Ransomware no longer breaks in. It logs in | The Manila Times

Category: Ransomware

Tags: credential theft, phishing, ransomware delivery, kernel filter driver, file system security, mfa bypass, payload blocking