1. Executive summary
Sophos's State of Ransomware 2026 report, based on a survey of 2,158 IT and security leaders whose organisations were hit in the past year, finds that malicious email and phishing now account for ~50% of ransomware incidents. Stolen credentials follow closely; nearly 80% of attacks opened with an identity-based move. Exploited software flaws dropped to 18% of initial-access vectors, down from ~33% year-over-year. Average recovery costs (excluding ransom) rose to $1.7M, while median ransom demands fell to ~$700,000 and median payments to $769,000. For EMEA financial services, the strategic risk is clear: the dominant attack path is now credential phishing via email, not vulnerability exploitation, and MFA coverage gaps are a primary failure point.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. This is a sector-wide trend report, not a specific incident or third-party failure. The findings are relevant to general ICT risk management posture, but no distinctive fact in this item triggers a specific article obligation that would change what a client must do under DORA or NIS2.
3. Technical analysis & attack chain
This advisory summarises a strategic trend report, not a single incident. The attack chain below reflects the dominant pattern described in the Sophos survey data.
Dominant attack chain (corroborated by survey of 2,158 victim organisations)
- Initial access — phishing email. An employee receives an email that appears routine, clicks a link, and enters credentials into a credential-harvesting page. Malicious email and phishing together account for ~50% of all ransomware incidents.
- Credential compromise. Stolen credentials are used to authenticate. Nearly 80% of attacks began with an identity-based move — either stealing a credential or reusing one already compromised. Two-thirds of victims reported their ransomware incident was the same event as their worst identity breach.
- MFA bypass or coverage gap. MFA was in place for nearly every credential-based attack, but coverage gaps and bypass methods allowed attackers through. The report does not specify which bypass techniques were used.
- Entry via internet-facing applications. Among attacks starting with a stolen login, software flaw, or brute force, exposed internet-facing applications were the most common opening point — ahead of user devices and firewalls.
- Encryption and data theft. Data was encrypted in 56% of attacks, the first increase after two years of decline. ~16% of cases involved both encryption and data theft, giving attackers dual leverage.
- Ransom demand. Attackers sized demands to the target — six figures for the smallest firms, millions for the largest enterprises — indicating reconnaissance before the ransom note is deployed.
Key findings and confidence
- Exploited software flaws declined sharply to 18% (from ~33%), ending a three-year run as the leading vector. Sophos warns this could reverse as AI tools accelerate vulnerability discovery. Single-sourced to the Sophos survey.
- Human error grew as an operational factor contributing to compromise. Specifics on what "human error" encompasses are not provided.
- Recovery posture improved. Two-thirds of victims with encrypted data recovered from backups (up from ~55% the prior year). Over half of victims resumed operations within one week; average recovery held at ~three weeks.
- No named threat actors, specific malware families, CVEs, or technical IOCs are provided in the source material. Attribution is not discussed.
4. Mitigation & containment
P1 — within 24 hours
- Review MFA coverage for all internet-facing applications, especially email portals, VPN concentrators, and remote access gateways. The report explicitly states MFA was present in nearly every credential-based attack but failed due to coverage gaps or bypass methods. Identify accounts with partial MFA enrollment (e.g., SMS-only, no MFA on legacy apps, excluded service accounts).
- Audit exposed internet-facing applications. These were the most common opening point for attacks involving stolen logins, software flaws, or brute force. Inventory all externally reachable services and validate necessity.
P2 — within 72 hours
- Strengthen email security controls. Phishing and malicious email account for ~50% of initial access. Review email gateway rules, URL rewriting, attachment sandboxing, and user reporting workflows. Ensure DMARC enforcement (p=reject) is in place.
- Validate backup integrity and recovery procedures. Two-thirds of victims recovered from backup. Confirm offline/immutable backups exist, test restoration for critical financial systems, and verify RTO/RPO targets meet business requirements.
- Review identity-breach correlation. Two-thirds of victims reported their ransomware incident was the same event as their worst identity breach. Ensure credential compromise detection (impossible travel, anomalous logins, token theft alerts) feeds directly into containment playbooks.
P3 — within 7 days
- Conduct a phishing simulation exercise targeting credential-harvesting scenarios specifically, not just attachment-based malware. The dominant lure is a link to a credential capture page.
- Review helpdesk and password-reset procedures for social-engineering resistance. Stolen credentials are the second-leading access vector.
- Brief executive leadership on the shift in threat landscape: the dominant risk is now identity compromise via email, not unpatched software. Adjust security investment accordingly.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Credential entry on phishing landing page following email link click | Email gateway logs, web proxy logs, EDR browser telemetry | High — survey-corroborated as dominant vector |
| Authentication using stolen credentials against internet-facing applications | IAM logs, VPN authentication logs, SIEM | High — ~80% of attacks were identity-based |
| MFA bypass or enrollment gap exploitation during credential-based attack | MFA provider logs, identity provider audit logs | Medium — mechanism unspecified in source |
| Reconnaissance activity sizing the target before ransom demand deployment | EDR, network traffic analysis, AD audit logs | Medium — inferred from demand-to-revenue correlation |
| Bulk file encryption across network shares | EDR, file server audit logs, backup system alerts | High — 56% of attacks involved encryption |
6. Detection
Insufficient indicators to author detection rules. The source material is a survey-based trend report and does not contain specific malware strings, command-line arguments, file paths, registry keys, mutex names, or network signatures. Detection should focus on the behavioural indicators in §5 — credential phishing response, anomalous authentication patterns, and mass file modification — using existing SIEM/EDR content tuned for identity-based attack paths.
7. Sources
- Help Net Security / Sophos, "Ransom demands are down, email is the top way attackers get in," https://www.helpnetsecurity.com/2026/07/16/sophos-state-of-ransomware-2026/, published 2026-07-16.
8. Adverse Trace position
This is a strategic trend report, not a vulnerability or specific campaign advisory. The data is single-sourced (Sophos-commissioned survey) but draws on a large sample of 2,158 confirmed ransomware victims, giving it reasonable representativeness. The core takeaway for EMEA financial services clients is that the threat landscape has shifted: identity compromise via email is now the dominant ransomware entry path, and MFA alone is not stopping it. Clients should not deprioritise patching — Sophos itself warns vulnerability exploitation may rebound — but should rebalance defensive investment toward email security, identity threat detection, MFA hardening (moving beyond SMS to phishing-resistant factors), and backup resilience. We will monitor for follow-on technical reporting from Sophos that may provide actor attribution, malware specifics, or IOCs suitable for detection engineering. No CISA-KEV entries or specific CVEs are associated with this item.
Published via PulseTrace — Adverse Trace threat intelligence.