Cloud Identity Abuse Dominates Critical Infrastructure Attacks

Identity is the target

The most common technique attackers used against critical infrastructure in the past year did not involve a novel exploit or zero-day. It involved logging in. According to the Microsoft Digital Defense Report 2026, cloud identity abuse was the most frequently observed technique against critical-infrastructure targets, appearing in 78% of the activity Microsoft tracked. 2

SpecterOps, the company behind the BloodHound attack-path tool, reads the report as making identity "the common thread" across modern risk. It points to three drivers: identity sprawl, the growth of non-human identities such as service accounts, and AI agents that hold permissions of their own. 2 Those factors create interconnected access relationships that defenders struggle to inventory, and attackers can walk through them.

Attackers are mapping the graph

One of the report's more specific findings involves AzureHound, the data collection engine for BloodHound. AzureHound maps relationships and possible privilege-escalation paths inside Microsoft Entra ID (formerly Azure AD) and Azure Resource Manager. It made up 12% of the observed tool mix used against critical infrastructure, where it was used to map cloud attack paths. 2 Defenders and red teams built the tool to find weaknesses before adversaries do. That attackers now use it shows how easily they can read an organization's identity graph once they have a foothold.

SpecterOps also argues that most attack paths come from long-standing technical debt, such as old permissions, stale accounts, and nested group memberships. In its view, AI does not create these weaknesses. It shortens the time needed to find them and chain them together. 2 This analysis matters. If it is correct, AI mainly speeds up the exploitation of problems organizations already have.

Gunra shows the same pattern on premises

A joint advisory released August 10, 2026, by the FBI, NSA, CISA, and the U.S. Secret Service shows the same theme outside the cloud. 3 The alert, AA26-222A, covers Gunra, a ransomware-as-a-service operation whose affiliates target government and other organizations. 3

The intrusion it describes is a case study in account abuse. In one case, Gunra actors got onto an internet-connected workstation used by a network administrator, then reached the administrative web console of an SSL-VPN appliance. There they found an unused account with access to both the internet-facing network and the internal corporate network. 1 They changed that account's configuration to skip a mandatory password change, then used it for further malicious activity. CISA maps this to MITRE ATT&CK technique T1098, Account Manipulation. 1 The advisory's longer version adds that the actors got administrator access to the SSL-VPN appliance by exploiting default credentials, a step tracked as External Remote Services (T1133). 3 Once inside, Gunra affiliates regularly use the Impacket tools psexec.py and smbclient.py to move laterally over SMB. 3

The two versions of the advisory stress different entry points. One focuses on the compromised admin workstation. The other focuses on default credentials on the VPN appliance. 13 They are best read as complementary details of the same chain rather than conflicting accounts. Either way, the attackers never had to break anything sophisticated. A dormant, overprivileged account and weak credential hygiene did most of the work.

Volume keeps climbing

The broader ransomware numbers add urgency. NCC Group counted 1,073 publicly disclosed ransomware attacks worldwide in August 2026, up 12% from 960 in July. 4 Industrial organizations were hit hardest, with 329 incidents, or roughly one in three. 4 NCC Group describes ransomware activity in 2026 as range-bound but elevated, and August was one of the higher monthly totals it logged this year. Coverage of its data also notes that new cloud-identity tactics are emerging. 4 NCC Group's figures come from leak-site postings, victim notifications, and incident-response work, so they likely undercount attacks that were never disclosed. 4

The reading: perimeter thinking is the debt

Taken together, these reports point one way. Whether the entry point is a cloud tenant mapped with AzureHound or an SSL-VPN account left unused, the decisive weakness is identity that nobody is actively governing. Microsoft's 78% figure, the AzureHound data, and the Gunra advisory all describe attackers who favor legitimate access over exploitation. 123 The rise in ransomware against industrial targets suggests that approach is paying off. 4

The practical lesson is not new, but it is getting harder to postpone:

• Audit and remove dormant accounts.
• Eliminate default credentials on edge appliances.
• Watch for changes to account policies, such as bypassed password requirements.
• Map your own identity attack paths before someone else does.

If AI is compressing the time attackers need to find these paths, as SpecterOps argues, defenders have less time to fix technical debt they have carried for years. 2