Ransomware crews increasingly target identity systems, admin controls and backups to stop victims recovering. June 2026 alone saw 721 publicly disclosed victims.
Our analysis
The shift from “encrypt files” to “own identity and recovery” is the defining ransomware trend of 2026. Control Active Directory and you can disable backups, escalate everywhere and dictate terms. For Cyprus businesses, any recovery plan that assumes your identity provider survives an incident is dangerously outdated — identity is the battleground.
What you should do
- Harden and tier Active Directory; close Kerberoasting, delegation and ACL escalation paths.
- Keep offline, immutable backups and rehearse restoring without trusting production AD.
- Deploy identity threat detection and alert on mass privilege changes.
- Validate the chain with AD pentesting, assumed-breach and red-team exercises.
How CyprusPentest helps: our Active Directory penetration testing closes escalation paths, and an assumed breach assessment plus red team operations test detection and recovery.
Source: Cybersecurity Insiders.