Ransomware Campaigns Leverage AI to Target Enterprise Identity Platforms

A recent survey of organizations that suffered business-disrupting ransomware attacks indicates that artificial intelligence is now a standard component of criminal operations. According to GBHackers, AI capabilities were present in 84% of the incidents reported by 1,200 IT and security professionals across nine countries. The data highlights a shift toward automated intrusion techniques that accelerate the breach lifecycle.

Root cause

The findings connect accelerated criminal operations with weaknesses in the systems governing enterprise access. Former US National Cyber Director Chris Inglis told CBS News that attackers use AI to identify weaknesses, tailor social engineering, and automate intrusions. Semperis security research executive Tomer Bar warned that large language models help criminals test encryption implementations, potentially reducing implementation mistakes that defenders might otherwise exploit for recovery.

Attack path

Attackers are focusing on identity infrastructure to gain persistent access. The survey found that 87% of victims reported attacks targeting or exploiting identity systems. Semperis noted that 44% of respondents encountered attacks exploiting their own AI agents or systems, while 40% faced direct AI-based attacks. This dual approach allows adversaries to manipulate existing technology while deploying new autonomous tools.

Affected versions

Active Directory emerged as the most prominent target, appearing in 51% of the reported identity-focused attacks. Microsoft Entra ID was targeted in 48% of cases, and Okta was involved in 27% of incidents. Organizations often experienced attacks involving more than one identity platform, indicating that compromising a single system rarely represents the full scope of the breach.

Mitigation

Deploying AI does not eliminate the need for established access controls and recovery planning. Nearly half of respondents successfully used AI for detection or response, while 23% said their defensive AI tools failed. Teams should ensure that identity governance policies remain strict and that backup systems are isolated from primary identity providers to prevent credential theft from compromising recovery efforts.

Detection notes

Security operations teams should monitor for anomalous authentication patterns, such as logins from unusual geographies or impossible travel scenarios. Check for sudden spikes in privileged account activity or service account usage outside normal maintenance windows. Look for indicators of automated credential stuffing or AI-generated phishing emails that bypass standard filters. Isolate compromised identity endpoints immediately to prevent lateral movement. Verify that multi-factor authentication is enforced for all administrative access and review conditional access policies for gaps.

Background: Phishing

Phishing tricks you into taking action by disguising malicious intent as legitimate communication. You stop it by verifying sources, using passkeys, and treating every unsolicited request as suspicious until proven otherwise. Technical controls like email authentication and network segmentation reduce risk but cannot eliminate human error.

Read the full guide: Phishing Defenses: Answers to 10 Critical Questions

What to do and how to stay safe: Active Directory

• Review active sessions and revoke tokens for any accounts exhibiting unusual login behavior or geographic anomalies.
• Enforce multi-factor authentication on all identity management platforms, ensuring it cannot be bypassed by legacy protocols.
• Audit permissions on sensitive identity services to ensure least-privilege access is applied to all service and user accounts.
• Isolate backup identity databases from the production network to prevent ransomware from encrypting recovery credentials.

Step-by-step guide: Incident Response Plan for Ransomware Attack: Stop the Spread

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this survey prove AI is used in most global ransomware attacks?

No, the findings describe reported experiences within a victim sample of 1,200 professionals, not a verified measurement of all attacks worldwide.

Which identity platforms are most at risk?

Active Directory and Microsoft Entra ID were the most frequently targeted platforms, appearing in 51% and 48% of cases respectively.

Are defensive AI tools effective against these attacks?

Results are mixed; 49% of respondents successfully used AI for detection, while 23% reported their defensive AI tools failed.