Sophos 2026 Active Adversary Report: Identity Failures Dominate Initial Access
Report discovered via Awesome Annual Security Reports.
Summary
Sophos analyzed 661 response cases and found identity-related issues accounted for 67.32% of root causes. Attackers reached Active Directory faster, while weak MFA and missing logs continued to undermine defenses.
Key points
- The report covers 661 selected IR and MDR cases from November 1, 2024, through October 31, 2025; 84% involved organizations with fewer than 1,000 employees.
- Identity-related root causes accounted for 67.32% of cases, including compromised credentials, brute force, phishing, and authentication-token theft. MFA was absent or incompletely configured in 59.46% of incidents.
- Attackers attempted Active Directory access a median of 3.40 hours after initial access, 70% faster than the previous year. Overall median dwell time was three days.
- Sophos confirmed exploited CVEs in 52 cases; 67.31% of those involved SonicOS vulnerability CVE-2024-40766. The median interval between advisory or patch publication and exploitation was 322 days.
- Impacket usage increased 83.08% year over year. Sophos recommends blocking Python where unnecessary, particularly on non-development workstations, and applying controls and logging where it is required.
- A FlowerStorm phishing case used Dropbox and internal SharePoint documents to steal Microsoft 365 credentials and tokens. Weak MFA settings, delayed remediation, and unbound session tokens enabled repeated access.
- Missing logs continued to hamper investigations, with retention problems doubling. Sophos found no evidence of a revolutionary AI-driven change in its casework, while acknowledging difficulty proving GenAI use.
Article Details
- Publisher
- Sophos
- Report Period
- 2024-11-01 to 2025-10-31
- Scope
- Selected Sophos IR and MDR investigations, including Secureworks IR cases, spanning 70 nations and other locations and 34 industries.
- Sample Size
- 661 selected cases; 69% MDR and 31% IR. Organizations with fewer than 1,000 employees accounted for 84% of the dataset.
- Key Statistics
- Identity-related issues accounted for 67.32% of root causes in the report's 2025 dataset.
- MFA was either not enabled or not fully configured in 59.46% of incidents.
- Investigators confirmed exploited CVEs in 52 cases; 67.31% of those cases involved CVE-2024-40766.
- Median dwell time was three days overall, compared with five days for IR cases and two days for MDR cases.
- Median time from initial access to attempted Active Directory access fell to 3.40 hours, a 70% decrease from the previous year.
- Recommendations
- Deploy and verify strongly configured, phishing-resistant MFA, require frequent re-authentication, and use Token Protection in M365 where possible to prevent stolen session-token replay.
- Block Python where it is not required, particularly on non-development workstations; apply logging and additional controls where its use is necessary.
- Retain investigation telemetry, including firewall logs, using alternate storage when appliance retention is insufficient.
- Close exposed RDP ports, patch vulnerable servers, and prioritize retiring unnecessary end-of-life systems.
- Protect systems wherever possible and implement additional mitigations and controls for systems that cannot be protected.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe report observed internal RDP use in 66% of cases and external RDP use in 10%.T1059.006 · PythonAttackers used Python to execute Impacket tooling.T1078 · Valid AccountsAttackers used compromised credentials to gain access, including successful sessions through compromised M365 accounts.T1110 · Brute ForceBrute-force attacks accounted for 15.58% of root causes in the dataset.T1486 · Data Encrypted for ImpactInvestigations documented ransomware deployment and recurring abuse of native BitLocker encryption.T1539 · Steal Web Session CookieFlowerStorm phishing pages captured authentication tokens alongside victim credentials.T1550.004 · Web Session CookieThe case-study attacker replayed a stolen, unbound session token to maintain access without an additional MFA prompt.T1564.008 · Email Hiding RulesThe attacker created inbox rules that moved specified emails to victims' RSS folders to conceal activity and delay detection.T1566.002 · Spearphishing LinkThe case study describes phishing emails distributing links to malicious documents and credential-harvesting pages.
CVE
People
Threat Actors
AkiraLeading ransomware brand observed in the dataset; the report gives Gold Sahara as its Secureworks name.Gold EncoreSecureworks name given for Play.Gold FeatherSecureworks name given for Qilin.Gold LeapfrogSecureworks name given for SafePay.Gold SaharaSecureworks name given for Akira, the leading ransomware brand observed.Gold SonicSecureworks name given for Inc.INCOne of the five leading ransomware brands observed; the report associates it with the name Gold Sonic.PlayOne of the five leading ransomware brands observed; the report associates it with the name Gold Encore.QilinSecond-most prevalent ransomware brand observed; the report gives Gold Feather as its Secureworks name.SafepayOne of the five leading ransomware brands observed; the report associates it with the name Gold Leapfrog.Scattered Lapsus$ HuntersThe report identifies the group as a prominent example of criminals weaponizing identity attacks in 2025.
Malware
AkiraAkira (in Secureworks parlance, Gold Sahara) and Qilin (Gold Feather) led the way, followed by SafePay (Gold Leapfrog), Inc (Gold Sonic), and Play (Gold Encore).INC ransomwareAkira (in Secureworks parlance, Gold Sahara) and Qilin (Gold Feather) led the way, followed by SafePay (Gold Leapfrog), Inc (Gold Sonic), and Play (Gold Encore).LockBitLooking at ransomware brands in our dataset from 2020 to 2025, three brands (LockBit, Medusa, Phobos) and one technique (abuse of native BitLocker encryption) have persisted for the duration.MedusaLooking at ransomware brands in our dataset from 2020 to 2025, three brands (LockBit, Medusa, Phobos) and one technique (abuse of native BitLocker encryption) have persisted for the duration.PhobosLooking at ransomware brands in our dataset from 2020 to 2025, three brands (LockBit, Medusa, Phobos) and one technique (abuse of native BitLocker encryption) have persisted for the duration.PlayWhile detection and response have proven reliable in the fight against attackers, we can't forget the role that prevention can play.QilinAkira (in Secureworks parlance, Gold Sahara) and Qilin (Gold Feather) led the way, followed by SafePay (Gold Leapfrog), Inc (Gold Sonic), and Play (Gold Encore).SafePayAkira (in Secureworks parlance, Gold Sahara) and Qilin (Gold Feather) led the way, followed by SafePay (Gold Leapfrog), Inc (Gold Sonic), and Play (Gold Encore).
Vendors
Secureworks2024 and October 31, 2025 by Sophos Incident Response (IR) teams, including those operating within our Secureworks group, and by the response team that handles critical cases occurring among our Managed Detection andSonicWallcases, over two-thirds (67.31%) exhibited use of CVE-2024-40766, the SonicOS bug repeatedly patched by SonicWall over the course of the year.Sophosfor this edition is drawn from selected cases handled between November 1, 2024 and October 31, 2025 by Sophos Incident Response (IR) teams, including those operating within our Secureworks group, and by the response
Products
AnyDeskOf the legitimate commercial tools being abused, AnyDesk is still the most abused remote access tool; SoftPerfect's Network Scanner is the most abused network enumeration tool, and WinRAR is the most abused archivingDropbox DocSendThe first wave of phishing emails in this campaign was sent to multiple employees from an external Dropbox account masquerading as a trusted employee within the organization. The attacker leveraged the Dropbox “ShareM365In our data, most of these engagements turned out to be compromised M365 identities leading to attempted (or, less frequently, successful) financial theft or resource hijacking, as attackers tried to use organizations’Microsoft Active DirectoryUnfortunately, the attackers' appetite for accessing Active Directory (AD) servers has not been sated. The speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over lastMicrosoft Entra IDDue to infrequent MFA prompt requirements and long-lived session token lifetime (the Microsoft Entra ID default token lifetime is 90 days, which though not as unreasonable as Slack’s ten years is still long), theMicrosoft SharePointcompromised M365 accounts, created the same malicious PDF document within that employee’s internal SharePoint, and sent a second wave of phishing emails out from the user’s email address. Not only was theSonicOSAmong the exploited vulnerability cases, over two-thirds (67.31%) exhibited use of CVE-2024-40766, the SonicOS bug repeatedly patched by SonicWall over the course of the year.Windows Serverthe time between when AD access is attempted and when the attack is detected has risen by 16%. Of the Windows Server versions we were able to identify, 13% were running end-of-life versions, with a further 27% soon toWinRARabused remote access tool; SoftPerfect's Network Scanner is the most abused network enumeration tool, and WinRAR is the most abused archiving tool.
Tools
atexecspecific changes. This year, Impacket continues to lead the way when we combine all Impacket tools (e.g. atexec, secretsdump, wmiexec, etc.), followed closely by Python — which Impacket requires to execute. ImpacketCobalt Strike- [Some rise, some fall: Python and Cobalt Strike](#some-rise-some-fall-python-and-cobalt-strike)FlowerStormtrusted employee in the subject line acted as bait — and multiple users bit, clicking on a malicious FlowerStorm URL contained within the document. Victims not only entered their credentials on the Dropbox portal butImpacketTool use year-on-year was consistent overall, but with important specific changes. This year, Impacket continues to lead the way when we combine all Impacket tools (e.g. atexec, secretsdump, wmiexec, etc.), followedsecretsdumpThis year, Impacket continues to lead the way when we combine all Impacket tools (e.g. atexec, secretsdump, wmiexec, etc.), followed closely by Python — which Impacket requires to execute. Impacket accountedSoftPerfect Network Scannercommercial tools being abused, AnyDesk is still the most abused remote access tool; SoftPerfect's Network Scanner is the most abused network enumeration tool, and WinRAR is the most abused archiving tool.wmiexecyear, Impacket continues to lead the way when we combine all Impacket tools (e.g. atexec, secretsdump, wmiexec, etc.), followed closely by Python — which Impacket requires to execute. Impacket accounted for 36.01% of
Industries
ConstructionFinancial (8.93%), Construction (8.62%), Information Technology (6.96%), and Healthcare (6.35%) round out the top five.financialFinancial (8.93%), Construction (8.62%), Information Technology (6.96%), and Healthcare (6.35%) round out the top five.HealthcareFinancial (8.93%), Construction (8.62%), Information Technology (6.96%), and Healthcare (6.35%) round out the top five.Information TechnologyFinancial (8.93%), Construction (8.62%), Information Technology (6.96%), and Healthcare (6.35%) round out the top five.ManufacturingAs has been the case in our Active Adversary Reports since we began, the manufacturing sector (19.82%) was the most likely to request Sophos X-Ops response services.