Topic starter
25/06/2026 1:27 am
TL;DR: Ransomware affected 78% of respondents in the past year and 83% of attacks on global manufacturing organisations compromised identity infrastructure, according to Semperis, with Foxconn used as a current example of how identity-first intrusion can precede exfiltration, domain dominance, and recovery disruption. Recovery speed matters less than proving AD can be restored to a clean state.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “When the Lights Go Out: What the Foxconn Breach Tells Us About Identity-First Ransomware”.
By the numbers:
- 78% of respondents were targeted by ransomware in the previous 12 months, according to Semperis.
- 83% of ransomware attacks on global manufacturing organisations compromised identity infrastructure, according to Semperis.
- Only 65% of manufacturers include AD-specific recovery procedures in their disaster recovery plan, according to Semperis.
Key questions
Q: What breaks when attackers gain control of Active Directory during a ransomware attack?
A: If attackers control Active Directory, they can create new privileged accounts, push ransomware across endpoints and servers, and take over a large part of the environment.
Q: Why does identity compromise make ransomware harder to recover from?
A: Identity compromise makes recovery harder because the directory can preserve attacker access even after affected servers are rebuilt.
Q: What are the signs that AD controls are failing in a manufacturing environment?
A: Common signs include excessive service account privilege, stale admin accounts, unexplained privileged group changes, weak delegation, and incomplete AD-specific recovery planning.
Practitioner guidance
- Map AD attack paths from standard users to Tier 0 Identify the shortest routes from ordinary accounts to domain controller control, privileged group membership, or recovery infrastructure.
- Separate AD recovery from general disaster recovery Write and test AD-specific recovery procedures that assume the directory itself may be compromised.
- Continuously monitor identity changes for attack patterns Detect DCSync activity, Golden Ticket creation, AdminSDHolder modification, and unauthorised privileged group changes.
Bottom line: Ransomware in manufacturing increasingly begins with identity compromise, which makes Active Directory a production risk as much as an IT risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:53 am
Identity-first ransomware is really identity-layer compromise, not a backup failure. The operational outage is visible, but the control failure begins earlier when AD becomes the attacker’s path to persistence and privilege. In manufacturing, that means the directory is part of the production trust chain, not a side system. Practitioners should therefore frame ransomware readiness as identity resilience, not only endpoint defence.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Compromised credentials take an average of 246 days to identify and contain, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should manufacturers reduce ransomware risk when AD is the control plane?
A: Manufacturers should tighten privilege paths, separate AD recovery from generic disaster recovery, and validate backup integrity before restoration. They also need identity-specific detection for escalation and persistence, because generic security tooling often misses the context that makes directory abuse dangerous.
👉 Read our full editorial: Identity-first ransomware in manufacturing exposes AD as the attack surface