AI Used in 84% of Ransomware Attacks as Identity Infrastructure Comes Under Fire.
Semperis survey of 1,200 ransomware victims finds AI in 84% of incidents and identity systems widely targeted.
Semperis surveyed 1,200 IT and security professionals in nine countries who had already suffered disruptive ransomware. Respondents said AI featured in 84% of incidents and 87% involved attacks on identity infrastructure, including Active Directory (51%), Microsoft Entra ID (48%), and Okta (27%). The figures are self-reported victim experiences, not forensic proof of AI use. Repeat attacks hit 69%, 59% paid ransom at least once, and only half maintained dedicated identity backups.
- Survey covered 1,200 professionals whose organizations suffered disruptive ransomware.
- 84% reported AI in incidents; 87% saw identity infrastructure targeted.
- Active Directory 51%, Entra ID 48%, and Okta 27% were cited as targets.
- 69% suffered repeat attacks and 59% paid ransom at least once.
- Only 50% kept dedicated identity backups; Okta recovery procedures covered 28%.
Full article573 words · extracted from gbhackers.com · click to collapse
Artificial intelligence appeared in ransomware incidents affecting 84% of surveyed victims, while 87% reported attacks targeting or exploiting identity infrastructure.
The findings connect accelerated criminal operations with weaknesses in the systems governing enterprise access.
The study surveyed 1,200 IT and security professionals across nine countries and eight industry sectors. Crucially, it included only organizations that experienced successful ransomware attacks causing business disruption.
The headline figure therefore describes reported experiences within a victim sample, not a verified measurement of all ransomware attacks worldwide.
The findings should be interpreted as survey evidence, rather than independent forensic confirmation of AI involvement across incidents.
These categories distinguish adversaries using AI capabilities from attackers manipulating technology already deployed inside victim environments.
Former US National Cyber Director Chris Inglis told CBS News that AI helps attackers identify weaknesses, tailor social engineering, automate intrusions, and adjust tactics during defensive responses.
He also said autonomous ransomware attacks are already occurring, although the survey does not establish how many incidents were fully autonomous.
Semperis security research executive Tomer Bar warned that large language models can accelerate malicious code development and help criminals test encryption implementations.
His assessment suggests fewer implementation mistakes could undermine opportunities for defenders to recover encrypted information without paying.
The defensive picture remains mixed. Nearly half of respondents, 49%, successfully used AI for detection or response, while 23% said their defensive AI tools failed.
These findings indicate that deploying AI does not eliminate the need for established access controls and recovery planning.
Semperis reported that, 40% of respondents experienced AI-based attacks, while 44% encountered attacks exploiting their own AI agents or systems.
AI-Powered Ransomware Attacks
Active Directory, Microsoft Entra ID, and Okta emerged as prominent targets. The report lists Active Directory at 51%, Entra ID at 48%, and Okta at 27%; organizations could experience attacks involving more than one identity platform.
The technical concern extends beyond encrypted files. Identity infrastructure determines which users, services, and applications receive access.
Compromising this layer can let adversaries abuse trusted privileges, while manipulated AI agents introduce another route for exploiting permissions already available inside an organization.
Semperis crisis management executive Courtney Guss warned that task-driven agents seeking additional permissions could expose identity systems to unintended compromise.
The report consequently recommends restricting agentic AI access to identity infrastructure rather than treating internal automation as inherently trustworthy.
Only 50% of surveyed organizations maintained dedicated identity backups, and 42% had automated identity recovery solutions.
Documented recovery procedures covered Active Directory in 60% of organizations, Entra ID in 52%, and Okta in just 28%.
This gap matters because restoring business systems without returning identity infrastructure to a trusted state risks reintroducing attacker access.
Semperis emphasizes secure identity restoration as a prerequisite for operational recovery, not simply another backup task.
Repeat compromise compounds the pressure: 69% of victims experienced multiple successful attacks, and 59% paid ransom at least once.
Meanwhile, 37% reported threats against employees’ friends or families, demonstrating that extortion increasingly extends beyond corporate systems.
For security leaders, the report’s central implication is operational: constrain AI permissions, prepare identity-specific recovery procedures, and rehearse coordinated crisis response.
Faster detection alone cannot compensate for an identity environment that remains compromised after systems return online.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Mayura Kathirhttps://gbhackers.com/
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.