Ransomware and healthcare targeting are rising across critical sectors

At a glance

What this is: This is Airlock Digital’s analysis of the ASD ACSC annual cyber threat report, highlighting ransomware, critical infrastructure targeting, and unusually high success rates against healthcare.

Why it matters: It matters because endpoint execution control, privileged software governance, and OT-aware resilience planning are now direct inputs to ransomware containment and sector-specific risk reduction.

By the numbers:

• The ASD ACSC responded to 138 ransomware incidents in FY2024-25, and 39% were cases where the agency contacted the entity to warn of a possible cyber security incident.
• The ASD ACSC notified critical infrastructure entities of potential malicious cyber activity impacting their networks over 190 times in 2024-2025, up 111% from the previous year.
• Malicious actors were successful in 95% of healthcare and social assistance incidents the ASD ACSC responded to in 2024-2025.

👉 Read Airlock Digital's analysis of ransomware, critical infrastructure, and healthcare targeting

Context

Ransomware and sector-targeted intrusion campaigns are not just a malware problem. They expose whether organisations can prevent untrusted code from executing, contain living off the land activity, and keep essential services running under pressure. For identity and access teams, the issue is not only endpoint hardening but also how privilege, software trust, and operational exceptions are governed across business-critical environments.

The ASD ACSC report is a reminder that the line between cyber hygiene and resilience is narrowing. In healthcare, critical infrastructure, and other essential services, the practical question is whether security controls can stop execution early enough to limit blast radius. That is typical of environments where legacy operational demands, software sprawl, and broad exception handling make containment harder.

Key questions

Q: How should security teams detect ransomware before encryption starts?

A: Security teams should watch for identity anomalies that precede encryption, such as unusual administrative logins, privilege changes, remote tool use, and access to directory or backup systems. Those signals often appear before the payload is deployed. The fastest wins come from routing identity telemetry into SIEM and IAM workflows so responders can investigate behaviour, not just malware.

Q: Why do living off the land techniques make ransomware harder to contain?

A: They reuse built-in tools and legitimate admin utilities, which can make attacker activity look like normal operations. That reduces the value of simple malware signatures and shifts the burden to runtime policy, process monitoring, and privilege restriction. The more trusted the tool, the more careful teams must be about who can run it and when.

Q: What breaks when application control exceptions are too broad?

A: Broad exceptions turn a prevention control into a partial filter. Attackers can target the same trusted paths that business users and administrators rely on, which creates a predictable route around policy. Over time, exception sprawl also weakens accountability because nobody can quickly explain which binaries are truly approved on which assets.

Q: Should healthcare and critical infrastructure teams manage endpoint control differently from office IT?

A: Yes. Critical services often include legacy systems, OT dependencies, and availability constraints that make blanket policy harder to apply. Teams should use tighter change governance, more granular allowlists, and clearer ownership for exceptions. The goal is to keep essential systems running without turning operational necessity into permanent software trust.

Technical breakdown

Deny by default execution control and malware containment

Modern application control works by allowing approved applications to run and blocking everything else unless it matches a trusted rule, signer, or policy. This is different from detection after execution because the control sits at the point of launch, which is especially relevant for ransomware and untrusted tooling. It also reduces the value of commodity payloads, scripted droppers, and attacker-supplied binaries that rely on permissive execution paths. In practice, its strength depends on policy quality, signing governance, and exception handling across endpoints and servers.

Practical implication: teams should treat application allowlisting as a prevention control, not a post-compromise detection layer.

Living off the land techniques and trusted binary abuse

Living off the land techniques use built-in operating system tools, approved scripts, or legitimate administration utilities to move, persist, or execute payloads without dropping obvious malware. That makes them harder to block with signature-based controls alone because the activity can look operationally normal. The security challenge is not just identifying a malicious file, but distinguishing sanctioned administration from attacker-driven use of the same binaries. This is where execution policy, script control, and detailed logging intersect with investigation and accountability.

Practical implication: restrict high-risk native tools and monitor unusual execution patterns rather than relying only on malware detection.

Critical infrastructure security across IT and OT environments

Critical infrastructure environments often blend IT systems, OT systems, and specialised applications that were not designed with modern threat assumptions. That creates a larger exception surface because many assets cannot be patched or changed on the same timetable as office IT. Application control is relevant here because it can reduce the range of executable software even where direct hardening options are limited. For healthcare, energy, and similar sectors, the governance challenge is to keep essential services available without allowing broad trust in software that has never been formally approved.

Practical implication: apply tighter execution governance to OT-adjacent systems and review exemptions as a resilience risk, not just an IT inconvenience.

Threat narrative

Attacker objective: The attacker aims to disrupt operations, pressure the victim into recovery costs or ransom payment, and maximise downtime across business-critical services.

1. Entry often begins with a trusted execution path, malicious attachment, or exposed endpoint that permits attacker-controlled code to start under a legitimate-looking process.
2. Escalation follows when attackers use living off the land tools, credential access, or administrative utilities to suppress defenses and expand control without obvious malware.
3. Impact occurs when ransomware encrypts systems, disrupts operations, or forces recovery work that degrades service availability and increases business and regulatory exposure.

NHI Mgmt Group analysis

Execution control is becoming a resilience control, not just an endpoint hardening measure. Ransomware is no longer only about malicious files reaching a machine. When attackers can abuse legitimate software paths, the boundary between prevention and resilience collapses. Application allowlisting, signer governance, and exception discipline now sit in the same risk conversation as backup strategy and recovery testing. Practitioners should treat executable trust as a board-level resilience issue, not an endpoint niche.

Healthcare’s high success rate shows that sector context matters more than threat headlines. A 95% success rate in healthcare and social assistance incidents points to control weakness, not attacker novelty alone. These environments carry operational constraints, legacy technology, and broad availability requirements that can weaken prevention if software trust is poorly governed. That makes the sector a useful warning for any programme running mixed IT and OT estates. Practitioners should assume that critical service design shapes attack success as much as the malware itself.

Living off the land creates an execution trust gap. The article’s emphasis on application control maps to a deeper problem: attackers increasingly do not need to introduce exotic tools if they can reuse approved binaries. That trust gap is a governance problem because security teams often approve software categories rather than specific runtime behaviours. The named concept here is execution trust gap, meaning the difference between what software is formally allowed and how it is actually used. Practitioners should close that gap with tighter runtime policy and better telemetry.

Identity and privilege management still matter even in an endpoint-led story. Endpoint controls reduce execution opportunities, but ransomware campaigns succeed faster when administrative access is broad, standing, and poorly monitored. That is where identity governance intersects with application control. Privileged accounts, service accounts, and recovery access must be tightly scoped because attackers often pair execution with privilege abuse. Practitioners should align endpoint control with PAM and access review discipline rather than treating them as separate programmes.

What this signals

Application control is increasingly a policy layer for resilience, not just an endpoint security feature. As attackers rely more on legitimate tools and approved software paths, programmes need tighter software trust governance, better exception hygiene, and stronger ties between endpoint policy and privilege management.

Execution trust gap: organisations that approve software by category but do not govern runtime behaviour are leaving a predictable opening. That is where endpoint policy, privileged access control, and immutable logging need to converge if resilience is going to be measurable rather than assumed.

For practitioners

• Implement deny-by-default execution policies Start by restricting software execution to approved publishers, hashes, or application paths on the highest-risk systems, then expand coverage in phases to servers, laptops, and OT-adjacent endpoints.
• Audit living off the land exposure Identify which native tools, scripts, and admin utilities can be abused for execution, persistence, or lateral movement, then narrow who can invoke them and under what conditions.
• Tighten exception governance for critical services Review any application allowlist exceptions, temporary approvals, and operational overrides on healthcare, energy, and other essential service assets as time-bound risk decisions.
• Align endpoint controls with privilege reviews Map administrative accounts, recovery roles, and service credentials to the systems that can launch high-risk binaries, then remove standing access wherever it is not operationally necessary.

Key takeaways

• The report reinforces that ransomware prevention now depends on blocking unauthorised execution, not only detecting malicious files after launch.
• Healthcare and critical infrastructure remain exposed because operational constraints and trust exceptions make containment harder than in standard office environments.
• Teams should pair application control with privilege governance and exception discipline if they want to reduce blast radius before ransomware starts spreading.

Key terms

• Application control: Application control is the enforcement of which software may run on a device and under what conditions. It is a key governance layer because unauthorized or unsafe code can undermine access assurance even when authentication and device enrolment are in place.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Deny By Default: Deny by default is an authorization rule that blocks access unless a policy explicitly permits it. It is the safer baseline for modern identity control because it limits accidental privilege expansion and makes every access grant visible, testable, and easier to review.
• Exception-Based Governance: A control approach that focuses human and automated response on meaningful deviations instead of reviewing every event equally. In AI and NHI programmes, it is the practical way to scale oversight without forcing manual inspection of all activity.

What's in the full article

Airlock Digital's full blog covers the operational detail this post intentionally leaves for the source:

• The report-specific breakdown of the ASD ACSC findings and how the vendor maps them to application control use cases.
• More detail on Deny by Default enforcement patterns and how they are applied across different endpoint populations.
• Implementation guidance for extending protection across IT and OT systems without weakening software trust governance.
• A fuller discussion of execution logging and how immutable records support investigations and compliance.

👉 Airlock Digital's full blog expands on application control, OT coverage, and the ASD ACSC findings.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect runtime trust decisions to broader identity governance programmes.