Ransomware crews increasingly target identity systems, admin controls and backups to stop victims recovering. June 2026 alone saw 721 publicly disclosed victims.
Our analysis
The shift from “encrypt files” to “own identity and recovery” is the defining ransomware trend of 2026. Control Active Directory and you can disable backups, escalate everywhere and dictate terms. For Cyprus businesses, any recovery plan that assumes your identity provider survives an incident is dangerously outdated — identity is the battleground.
What you should do
- Harden and tier Active Directory; close Kerberoasting, delegation and ACL escalation paths.
- Keep offline, immutable backups and rehearse restoring without trusting production AD.
- Deploy identity threat detection and alert on mass privilege changes.
- Validate the chain with AD pentesting, assumed-breach and red-team exercises.
How CyprusPentest helps: our Active Directory penetration testing closes escalation paths, and an assumed breach assessment plus red team operations test detection and recovery.
Source: Cybersecurity Insiders.
Why attackers go after identity, not files
Encrypting files is noisy and recoverable from backups. Owning identity is quiet and total: control Active Directory or your cloud identity provider and you can grant yourself access to everything, disable defences, and deploy ransomware everywhere at once from a position of trust.
That is why modern intrusions race toward Domain Admin or global admin. Kerberoasting, delegation abuse and privilege-escalation paths are the routes — and finding them first, from an assumed-breach start, is the only reliable defence.
What this means for Cyprus businesses
Ransomware crews now target identity itself — because control of Active Directory or your identity provider means control of everything. For Cyprus businesses, identity is the primary battleground and a core GDPR concern.
How to reduce your exposure
- Harden Active Directory and cloud identity: tiered admin, no standing privileges, MFA everywhere.
- Hunt Kerberoasting, delegation abuse and paths to Domain Admin.
- Monitor identity systems for anomalous authentication and privilege changes.
- Test identity attack paths with an assumed-breach mindset.
Test identity attack paths with Active Directory penetration testing and Entra ID security assessment — get a fixed-price quote for your Cyprus business.