Before the Ransom Note
79% of ransomware attacks start with an identity, not an exploit. Where intrusions actually begin — and the defenses that close the human entry points.
The ransom note is the only part of a ransomware attack designed to be seen. Everything that matters happened earlier — days or weeks earlier — and almost none of it looked like malware. It looked like an email, a login page, a help desk ticket, a phone call from "IT."
The Sophos State of Ransomware 2026 report, a vendor-agnostic survey of 2,158 IT and cybersecurity leaders in 17 countries whose organizations were hit in the past year, puts a number on that: 79% of ransomware attacks started with an identity-based approach. For the first time in four years, exploited vulnerabilities are not the leading root cause. Your people's inboxes, passwords, and approvals are.
That reframes what a ransomware defense is. Patching and endpoint protection still matter — but the front door has moved, and it is staffed by humans.
Where the intrusions actually begin
Sophos' root-cause breakdown reads like a tour of the human layer:
| Root cause | Share of ransomware incidents |
|---|---|
| Malicious email | 26% |
| Phishing | 24% |
| Compromised credentials | 23% |
| Exploited vulnerabilities | 18% |
| Brute-force attacks | 6% |
Malicious email and phishing together account for roughly half of all incidents, and compromised credentials — bought, stolen by infostealers, or harvested on fake login pages — add another quarter. The responder's view matches the survey: Coveware's Q2 2026 report found phishing and social engineering had moved back into the lead among initial access vectors in the cases it handled, with compromised credentials continuing to rise as a standalone vector and vulnerability exploitation declining.
The sequence that follows first access is well documented — it is the standard cyber kill chain, and ransomware crews walk it patiently. Reconnaissance inside the network, privilege escalation, disabling security tooling, locating backups, and quiet data exfiltration all come before anything is encrypted. Coveware observed lateral movement and exfiltration in 76% of cases each. The detonation, often outside business hours, is the finale of an operation that spent most of its runtime impersonating a legitimate user.
A supply chain, not a lone hacker
The person who phishes your employee and the group that encrypts your network are usually different people. Access is a product: initial access brokers compromise organizations and sell the foothold — credentials, VPN sessions, live shells — to ransomware affiliates who specialize in the later stages. The same specialization we traced in the phishing-as-a-service economy applies downstream: every stage of the intrusion is someone's business.
And the acquisition side of that business is increasingly conversational. Coveware's standout Q2 2026 actor, Silent Ransom (also tracked as Luna Moth), "relies heavily on high-touch social engineering to gain initial network access" — calling employees while posing as internal IT or help desk staff, and in some operations physically entering offices under the same pretext. Black Basta's documented playbook floods an inbox with mailing-list spam, then has "help desk" call the overwhelmed employee over Teams to install remote-access tooling. The Scattered Spider intrusions behind the MGM Resorts attack — roughly $100 million in quarterly impact — began with phone calls to an IT help desk, a pattern we examined in our guide to help desk impersonation attacks.
The control was on. Ninety-seven percent of victims whose attack began with compromised credentials had MFA enabled in some form. The attackers didn't break the factor — they went around it: a proxied login page, a reset obtained by phone, a push approval worn out of a tired employee.
That 97% figure, from the same Sophos survey, is the most clarifying statistic in this year's data. MFA coverage is no longer the differentiator between victims and non-victims; the kind of MFA and the human workflows around it are. Adversary-in-the-middle kits relay one-time codes and capture session cookies. MFA fatigue attacks turn push notifications into a persistence game. And a help desk that resets a factor for a convincing caller removes it entirely — which is why Coveware now argues that identity workflows such as help desk verification, password resets, and MFA resets should be treated as security controls in their own right.
What the finale costs
The back end of the attack is getting more expensive, not less. Sophos puts average recovery cost at $1.7 million per incident, up 11% year over year, with 56% of attacks succeeding in encrypting data — up from 50% the year before — and 48% of encrypted victims paying. Coveware's Q2 2026 numbers show an average payment of $1.88 million, inflated by a handful of large data-exfiltration cases, against a falling median of $150,000 and a record-low payment rate. The economics are polarizing: fewer victims pay, so the operators who do get paid extract more, increasingly by threatening leaks rather than withholding decryption keys. Sixty-seven percent of Sophos' respondents said their ransomware incident was the same event as their most significant identity attack — the two problems have merged.
Closing the doors the attackers actually use
A defense aligned to this data spends less on the finale and more on the opening acts — the conversations, logins, and resets where 79% of these attacks begin.
- Simulate the openings, not just the click. If your phishing simulations end at the link, you are not rehearsing credential entry, voice-call pretexts, or the "IT needs remote access" conversation — the scenarios Silent Ransom and Black Basta actually run. Measure the results per person and team so coaching goes where the risk is.
- Treat identity workflows as security controls. Require callback verification to a number on file — or live manager confirmation — before any password or MFA reset, especially for privileged accounts. The help desk script is part of your attack surface; test it the way you test your filters.
- Make the high-value factors phishing-resistant. Move admins, finance, executives, and IT staff to FIDO2/passkeys first, so a proxied login page captures nothing replayable. Our passkeys migration guide covers the rollout order.
- Assume one account falls; limit what it reaches. Network segmentation, least privilege, and MFA on internal and administrative access turn one compromised identity into a contained event instead of a domain-wide one. Application allowlisting and blocking unapproved remote-access tools close the "install this for me" path.
- Keep a backup the intruder cannot touch. Operators hunt reachable backups before detonating, so at least one copy needs to be air-gapped or immutable, with restores actually tested. Then plan for the half backups cannot fix: double extortion means stolen data is a separate threat with its own clock.
- Rehearse the human-layer incident. A tabletop exercise that starts with "an employee just approved an MFA prompt they didn't initiate" exposes different gaps than one that starts with encrypted servers — and the first hours of containment, covered in our incident response guide, decide whether first access becomes a ransom note.
Ransomware earned its reputation as a malware problem, and the payload still is one. But the 2026 data is unambiguous about the beginning: four out of five of these attacks start with an identity — a message someone trusted, a credential someone typed, a reset someone granted. Feed those signals into a human risk score and you can see which people, teams, and workflows your attackers would choose — and harden them before the note appears.
Frequently asked questions
How do most ransomware attacks start?
Through people, not software flaws. In the Sophos State of Ransomware 2026 survey of 2,158 organizations hit in the past year, 79% of attacks started with an identity-based approach: malicious email was the root cause in 26% of incidents, phishing in 24%, and compromised credentials in 23% — while exploited vulnerabilities, the former front-runner, fell to 18%. Coveware's Q2 2026 data shows the same shift from the responder's side, with phishing and social engineering moving back into the lead among initial access vectors. The encryption that makes headlines is the last step of an intrusion that usually began with a message, a login page, or a phone call.
Does MFA stop ransomware?
It raises the cost, but on its own it demonstrably does not stop the current playbook: Sophos found that 97% of victims whose attack began with compromised credentials had MFA enabled in some form. Attackers go around the factor rather than through it — adversary-in-the-middle phishing pages relay codes and capture session cookies, push-bombing wears users down into approving, and help desk calls get the factor reset entirely. MFA still belongs in every defense, but it needs to be phishing-resistant (FIDO2/passkeys) for high-value accounts, and the human workflows around it — enrollment, resets, recovery — need the same scrutiny as the factor itself.
What does an initial access broker do?
An initial access broker breaks into organizations and sells the access rather than using it — working credentials, a VPN session, a foothold on a workstation — typically on criminal forums. Ransomware operators and their affiliates are the main buyers: purchasing access lets them skip the intrusion work and start directly on reconnaissance and lateral movement. This division of labor is why the person who phished your employee and the group that eventually encrypts your network are usually different actors, and why defending the entry points disrupts the economics of the whole chain, not just one gang.
If we have good backups, can we ignore the ransom?
Backups neutralize the encryption threat, and offline or air-gapped copies should be non-negotiable — attackers routinely delete every backup they can reach before detonating. But most major operations now run double extortion: they steal data before encrypting, so restoring systems does nothing about the threat to publish customer records, contracts, or employee data. Some groups have dropped encryption entirely and extort on the stolen data alone. Backups are necessary, not sufficient; the exfiltration half of the threat has to be fought earlier, at the entry points and in the days of quiet movement before the ransom note.
NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.
Book a demo