Why do targeted ransomware campaigns still bypass mature defenses?

Why This Matters for Security Teams

Targeted ransomware still succeeds because mature controls are often tuned to stop commodity malware, not identity-led attacks that move from a single foothold to backup stores, hypervisors, and admin planes. Once an attacker steals a valid credential, MFA does not help much if the account already has standing privilege or trusted access paths. NIST Cybersecurity Framework 2.0 emphasises continuous governance, protection, and detection, but many environments still leave recovery systems and shared admin workflows outside that model.

The problem is especially visible in breaches where access to directory services or cloud control planes becomes the real blast-radius multiplier, such as the Cisco Active Directory credentials breach and the Codefinger AWS S3 ransomware attack. Those cases show how an initial compromise can turn into encryption, deletion, or extortion even when perimeter defenses look mature. In practice, many security teams encounter the real failure only after privileged identity reuse has already enabled recovery-system abuse, rather than through intentional testing of admin-path assumptions.

How It Works in Practice

Ransomware crews increasingly target identity infrastructure first, then use legitimate tools and approved sessions to reach critical systems. That means the security question is not only “Can malware execute?” but “Which identities can reach what, under what conditions, and how quickly can access be revoked?” This is where mature defenses often fracture: endpoint controls may detect encryption activity, while identity controls still permit broad access to backup repositories, virtualization consoles, or cloud management APIs.

A practical defense model starts with privilege reduction and segmentation across identity tiers. High-value workflows should use separate admin accounts, just-in-time elevation, and tight session logging. Recovery paths must be treated as production-critical, not as exempt infrastructure. NIST guidance and operational research both point toward continuous verification rather than trust-by-role, and the NIST Cybersecurity Framework 2.0 is useful when mapped to explicit identity and recovery controls.

• Remove standing privilege from domain admins, backup operators, and cloud admins where possible.
• Isolate backup infrastructure, vaults, and hypervisors from routine user and workstation access.
• Require just-in-time elevation with short-lived access and strong approval for recovery actions.
• Monitor identity events, not only malware telemetry, for unusual privilege escalation and lateral movement.
• Test restore, failover, and deletion paths as adversary targets, not just as disaster-recovery functions.

Research from NHIMG also highlights how quickly exposed credentials are acted on in the wild, with attacker dwell time shrinking dramatically after secret exposure in incidents such as the DeepSeek breach. That speed matters because ransomware operators often chain access before defenders can rotate secrets or revoke sessions. These controls tend to break down in environments with shared admin accounts and flat backup networks because one valid credential can still reach too much, too fast.

Common Variations and Edge Cases

Tighter identity controls often increase operational overhead, requiring organisations to balance faster recovery against stricter separation of duties. That tradeoff is real: backup teams want emergency access, but ransomware actors exploit the same exception path. Current guidance suggests treating exceptions as time-bound and auditable, not permanent. There is no universal standard for how much access recovery personnel should retain, so policy must reflect business continuity requirements and asset criticality.

Some environments make the problem worse. Hybrid identity stacks can leave cloud, on-prem, and SaaS admin roles inconsistently governed. Managed service providers may hold broad cross-tenant access that bypasses local segmentation. In air-gapped or heavily regulated environments, manual recovery processes can create “break glass” credentials that are rarely tested and often over-scoped. Mature defenses also fail when organisations assume endpoint EDR alone will stop ransomware, because the attacker may never need to deploy noisy payloads if encryption or deletion can be launched from a trusted console.

For that reason, the most resilient programs combine layered prevention with identity-centric response: rapidly disable compromised accounts, invalidate sessions, rotate secrets, and verify that backup and recovery controls are outside attacker reach before the next incident. Operationally, the lesson is simple: if a privileged identity can still walk from a workstation to restore systems without friction, ransomware operators will eventually find that path.

Related resources from NHI Mgmt Group

• Why do targeted phishing campaigns still work against mature organisations?
• Why do social engineering campaigns still succeed in mature enterprises?
• Why do vendor fraud and impersonation attacks bypass legacy email defenses?
• Why do still-valid secrets matter after public disclosure?