Ransomware persistence and identity weaknesses in enterprise defenses

At a glance

What this is: GlobalSign argues that modern ransomware is a multi-stage intrusion problem in which phishing, credential theft and exfiltration exploit identity weaknesses before extortion begins.

Why it matters: IAM, PAM and NHI teams need to treat ransomware as an access-control and recovery problem, because stolen credentials and weak account governance often determine how far the attack spreads.

By the numbers:

• Cybersecurity Ventures predicted in 2023 that one organisation will face a ransomware attack every 2 seconds by 2031, according to GlobalSign.

Context

Ransomware is not just a malware family that encrypts files. In enterprise environments it is usually a staged intrusion that starts with delivery, then seeks credentials, expands access, exfiltrates data and finally uses disruption as leverage. That progression makes identity governance part of the control surface, not a separate problem.

The article’s core governance gap is that organisations still talk about ransomware as an endpoint or backup issue, while the attack path often runs through email, user credentials, weak access management and unmanaged accounts. For identity teams, the practical question is whether authentication, privilege and recovery controls can resist a fast-moving intrusion chain.

This framing is typical of current enterprise ransomware analysis because the attack has become as much about access persistence and coercion as about encryption itself.

Key questions

Q: What fails first when ransomware reaches valid user accounts?

A: The first failure is usually trust in normal authentication. Once an attacker has valid credentials, the campaign no longer depends on exploiting a file or endpoint vulnerability alone. They can move laterally, access shared resources and prepare exfiltration through accounts that look legitimate, which is why identity controls must be part of ransomware containment.

Q: Why do stolen credentials make ransomware outbreaks harder to contain?

A: Stolen credentials matter because they turn the attacker into a valid user, which often bypasses basic trust checks. If those credentials belong to privileged users or support staff, the operator can enumerate systems, request access, and move through approved channels. That is why identity lifecycle, MFA resistance, and privilege scoping are central to containment.

Q: Ransomware resilience

A: The ability to keep critical operations running while an extortion campaign is active or recover quickly after impact. It combines detection, containment, identity control, recovery planning, and trust infrastructure readiness so the business can absorb disruption without losing continuity.

Q: When should organisations prioritise identity controls over backup tooling for ransomware defence?

A: Identity controls should come first when the environment still relies on shared admin accounts, weak MFA, exposed third-party paths, or long-lived service credentials. Backups matter, but they do not stop the attacker from deleting recovery points or exfiltrating data before encryption if access governance is weak.

Technical breakdown

Phishing as the delivery layer for ransomware

Email phishing remains the most common delivery path because it exploits human trust rather than software defects. Once a user interacts with a malicious message or link, the attacker can drop payloads, capture session material or direct the victim into a credential-harvesting flow. The delivery stage matters because it is often the first point where identity controls can stop the chain. Strong authentication, anti-phishing controls and user verification reduce the chance that a single mailbox event becomes enterprise-wide compromise.

Practical implication: tighten mail and identity controls at the point of entry, not after malware is already executing.

Credential theft turns a local infection into enterprise access

Ransomware campaigns often move from one compromised device to broader access by stealing credentials, tokens or cached session data. That step is what converts an endpoint incident into a network-wide identity problem, because the attacker can authenticate as a legitimate user or service and move laterally with less friction. Weak password hygiene, over-permissioned accounts and poor privileged access separation all increase the value of a stolen credential. In this model, authentication failures are operational enablers for the ransom event.

Practical implication: treat credential protection and privilege scope as part of ransomware resilience.

Exfiltration and extortion rely on access persistence

Modern ransomware commonly combines data theft with encryption so the attacker can pressure the victim twice, once through downtime and again through disclosure risk. That works best when the adversary can keep accessing data long enough to locate high-value files, move across shares and stage exfiltration before detonation. Backup only addresses the recovery side of the problem. If identity governance is weak, the attacker can return through other accounts, other endpoints or unmanaged access paths even after the first compromised system is isolated.

Practical implication: pair backup strategy with account containment, access review and rapid revocation.

Threat narrative

Attacker objective: The attacker wants to maximise leverage by combining operational disruption with stolen data and broader account access.

1. Entry commonly begins with phishing email delivery, which turns a trusted communication channel into the attacker’s initial access path.
2. Credential harvesting follows, allowing the ransomware operator to authenticate as a real user or reuse stolen access to reach more systems.
3. Escalation and exfiltration then use those accounts to gather data, spread across the environment and prepare the extortion phase.
4. Impact is achieved when files are encrypted and the victim is pressured to pay for recovery or disclosure relief.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware persistence is now an identity governance problem, not just a malware problem. The article shows that delivery, credential theft and exfiltration are linked stages, which means account control determines whether an initial infection becomes enterprise compromise. Backup and recovery matter, but they do not stop an authenticated attacker from moving through the environment. The practitioner conclusion is that identity governance must be measured as part of ransomware resilience.

Stolen credentials are the real bridge between infection and enterprise spread. Once ransomware operators can use valid accounts, the attack shifts from endpoint execution to trust exploitation. That is why password hygiene, MFA coverage, privilege separation and session containment matter more than isolated endpoint cleanup. The practitioner conclusion is that any account with broad access can become the attacker’s persistence channel.

Long-lived access creates ransomware persistence windows. When accounts, tokens or service credentials remain usable after compromise, attackers have time to exfiltrate data and return through alternate paths. That failure mode is closer to access lifecycle weakness than to a single technical exploit. The practitioner conclusion is to shorten access lifetime and eliminate unnecessary standing privilege across user and machine identities.

Ransomware recovery plans fail if they assume the attacker is gone when the screen locks. The article’s prevention guidance points to audits, incident response, monitoring and backup, but the deeper lesson is that response must start with identity containment and revocation. If compromised identities remain active, recovery becomes slower and more expensive. The practitioner conclusion is that containment should target access pathways first, not just encrypted endpoints.

Enterprise ransomware now depends on the identity weak points that traditional perimeter thinking leaves unmeasured. The post implicitly reinforces a control gap that organisations often miss: the same controls used to govern users, devices and access lifecycles also govern attacker mobility once phishing lands. The practitioner conclusion is that security teams should treat identity telemetry as part of ransomware detection and response.

What this signals

Ransomware now exposes the gap between endpoint defence and access governance. If phishing can still land a valid session or password, the attacker’s hardest problem is already solved. Security teams should therefore align phishing resistance, privilege minimisation and revocation workflows so the first compromised identity does not become the last control failure.

Access lifetime is becoming the deciding variable in ransomware impact. The shorter the period in which credentials remain usable after compromise, the less time an attacker has to move from entry to exfiltration. That makes session control, privileged access review and rapid token invalidation central to operational resilience.

Backup is necessary, but identity containment determines whether recovery is clean. If compromised accounts and tokens survive the incident, restoration can simply reintroduce the attacker into the environment. The operational signal is clear: response plans need identity revocation steps that execute before systems are brought back online.

For practitioners

• Harden email entry points against phishing Require phishing-resistant authentication where possible, block risky attachment and link patterns, and monitor mailbox rules that redirect or hide suspicious messages.
• Reduce the value of stolen credentials Shorten session lifetime, remove unnecessary standing privilege, and segment admin access so a single captured account cannot reach critical data tiers.
• Tie incident response to identity revocation Make account disablement, token revocation and privileged session termination part of the first containment wave, not a post-incident cleanup step.
• Audit third-party and internal access paths Review vendor, contractor and service accounts for dormant access, weak authentication and excessive permissions before a ransomware actor uses them as lateral movement paths.
• Test recovery under credential compromise Validate whether backup and restore still work when user, admin and service credentials are assumed compromised, including rebuilding access control before restoring data.

Key takeaways

• Ransomware is an access problem as much as a malware problem, because phishing and stolen credentials often determine how far an attack spreads.
• The article’s evidence points to a multi-stage pattern in which delivery, credential theft, exfiltration and extortion compound the damage.
• The strongest limiting control is identity containment, supported by rapid revocation, privilege reduction and recovery processes that assume account compromise.

Key terms

• Ransomware: Ransomware is malicious software or an attack campaign that blocks access to systems or data and then pressures the victim for payment. In modern incidents, encryption is often combined with theft, disruption, and coercion so the attacker can increase leverage before recovery is possible.
• Credential Theft: Credential theft is the unauthorized capture of secrets used to authenticate a user or workload, such as passwords, MFA codes, or security questions. In SaaS environments, it usually produces login events that defenders can inspect, but it still becomes dangerous when attackers combine it with token abuse or integration misuse.
• Identity Containment: The practice of revoking or constraining an identity’s ability to act after compromise is suspected. It goes beyond isolating the device and includes session termination, token revocation, privilege reduction, and validation of what the identity can still reach.
• Separation Of Privilege: A security principle that splits critical permissions so no single identity, role, or process can complete a high-risk action alone. It reduces the chance that one compromise becomes total control. In identity programmes, it is enforced through role boundaries, approvals, and workflow design.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, secrets management and workload identity. It helps security practitioners connect access control decisions to real operational risk across human and non-human identities.