Topic starter
25/06/2026 1:27 am
TL;DR: Semperis reports that 78% of respondents were hit by ransomware in the past year, and that 83% of attacks on global manufacturing organisations compromised identity infrastructure. That puts clean recovery of identity services ahead of simple system restoration.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “When the Lights Go Out: What the Foxconn Breach Tells Us About Identity-First Ransomware”.
By the numbers:
- 78% of respondents were targeted by ransomware in the previous 12 months, according to Semperis.
- 83% of ransomware attacks on global manufacturing organisations compromised identity infrastructure, according to Semperis.
- Only 65% of manufacturers include AD-specific recovery procedures in their disaster recovery plan, according to Semperis.
Key questions
Q: Why does identity compromise make ransomware harder to recover from?
A: Identity compromise makes recovery harder because the directory can preserve attacker access even after affected servers are rebuilt.
Q: What are the signs that AD controls are failing in a manufacturing environment?
A: Common signs include excessive service account privilege, stale admin accounts, unexplained privileged group changes, weak delegation, and incomplete AD-specific recovery planning.
Q: What breaks when attackers gain control of Active Directory during a ransomware attack?
A: If attackers control Active Directory, they can create new privileged accounts, push ransomware across endpoints and servers, and take over a large part of the environment.
Practitioner guidance
- Map AD attack paths from standard users to Tier 0 Identify the shortest routes from ordinary accounts to domain controller control, privileged group membership, or recovery infrastructure.
- Separate AD recovery from general disaster recovery Write and test AD-specific recovery procedures that assume the directory itself may be compromised.
- Continuously monitor identity changes for attack patterns Detect DCSync activity, Golden Ticket creation, AdminSDHolder modification, and unauthorised privileged group changes.
Bottom line: Ransomware in manufacturing increasingly begins with identity compromise, which makes Active Directory a production risk as much as an IT risk.
Glossary terms: Identity-first ransomware, Tier 0 Attack Path, Clean recovery, Identity Blast Radius
What's in the full article
Semperis' full article covers the operational detail this post intentionally leaves for the source:
- Purple Knight and Forest Druid usage patterns for assessing AD exposure and Tier 0 attack paths
- Directory Services Protector rollback behaviour for malicious identity changes
- Active Directory Forest Recovery sequencing and clean-state restoration considerations
- Crisis-readiness workflow detail for validating backups and recovery plans before an incident
👉 Read Semperis' analysis of identity-first ransomware in manufacturing and AD exposure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/06/2026 10:53 am
Identity-first ransomware is really identity-layer compromise, not a backup failure. The operational outage is visible, but the control failure begins earlier when AD becomes the attacker’s path to persistence and privilege. In manufacturing, that means the directory is part of the production trust chain, not a side system. Practitioners should therefore frame ransomware readiness as identity resilience, not only endpoint defence.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Compromised credentials take an average of 246 days to identify and contain, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should manufacturers reduce ransomware risk when AD is the control plane?
A: Manufacturers should tighten privilege paths, separate AD recovery from generic disaster recovery, and validate backup integrity before restoration. They also need identity-specific detection for escalation and persistence, because generic security tooling often misses the context that makes directory abuse dangerous.
👉 Read our full editorial: Identity-first ransomware in manufacturing exposes AD as the attack surface