Identity Attacks Eclipse Exploits as Top Ransomware Root Cause

Identity-based attacks have dethroned vulnerability exploits as the leading root cause of ransomware intrusions, marking a significant shift in attacker tradecraft, according to reporting from Dark Reading. Email-borne threats—including phishing kits, credential harvesting pages, and social engineering lures—now account for a greater share of ransomware deployments than traditional exploit chains. The pivot reflects a broader industry trend in which adversaries prefer to log in rather than break in, weaponizing human factors and weak authentication instead of pursuing expensive zero-day research.

The data exposes a troubling paradox in enterprise defenses: multifactor authentication (MFA) was deployed in 97% of observed credential-based attack chains, yet still failed to prevent compromise. Attackers have refined techniques such as MFA fatigue prompting, adversary-in-the-middle reverse-proxy phishing kits (notably Evilginx and Modlishka), OAuth session token theft, and SIM-swap escalations to defeat common MFA implementations. Security teams should immediately audit corporate exposure by running credentials through our email breach checker to identify whether employee accounts have already appeared in known dumps feeding these attacks.

Defenders are being pushed to retire SMS codes and push-notification prompts in favor of phishing-resistant standards such as FIDO2 hardware security keys, Windows Hello for Business, and certificate-based authentication. Equally important is credential hygiene: administrators and end users alike should validate password strength and uniqueness via a password checker, enforce conditional access policies tied to device posture, and deploy identity threat detection that flags impossible-travel logins, dormant account reactivation, and abnormal mailbox rule creation—common precursors to ransomware-stage lateral movement. A layered defense that pairs strong authentication with continuous identity monitoring is now table stakes for disrupting the modern ransomware kill chain.