Cloud Ransomware Shifts to Azure Identity Abuse as Attacks Rise

The number, and what sits behind it

Ransomware kept climbing in August 2026. NCC Group's monthly threat intelligence report counted 1,073 attacks worldwide, up 12% from 960 in July. Industrial organizations absorbed roughly a third of them, with 329 incidents. 4 The firm describes activity this year as range-bound but elevated, and August ranks among the higher months it has recorded. 4

Monthly totals can mislead. They depend on leak-site postings, victim notifications and incident-response work. 4 They show how often gangs strike, but not how they get in. The more important trend this month is the method: attackers increasingly operate through identity and cloud control planes rather than by detonating malware on laptops and servers. NCC Group itself flagged emerging cloud-identity tactics alongside the headline count. 4

Identity as the front door

Credential theft is now the leading cloud ransomware vector, according to an analysis from backup vendor Eon. 3 Attackers obtain valid logins through phishing, infostealers or credential stuffing, then sign in as ordinary users. 3 After that, they look for higher-privilege targets:

• service accounts with overly broad permissions
• non-human identities without multi-factor authentication
• admins who reuse the same password on-premises and in the cloud

The goal is Global Administrator or Owner-level control of the tenant. 3

Microsoft's documentation of Storm-0501 shows how this works in a hybrid environment. The group:

1. compromised on-premises Active Directory through known vulnerabilities
2. moved laterally across domains and Entra Connect Sync servers
3. ran a DCSync attack to extract password hashes
4. found a synced non-human account that held Global Administrator rights in Entra ID and lacked MFA
5. reset that account's on-premises password to gain full cloud admin access 3

At that point, encrypting endpoints is optional. An attacker with tenant-level control can delete backups, change data stores, or lock the organization out of its own environment.

Overlooked accounts and quiet configuration changes

A CISA advisory on Gunra ransomware, issued August 10, 2026, describes a similar pattern in more traditional infrastructure. 1 After compromising an internet-connected workstation used by a network administrator, Gunra actors opened the SSL-VPN administrative console. They found an unused account with access to both the internet-facing and internal corporate networks. 1 They then changed the account's settings to skip a mandatory password change and used it for further activity. CISA maps this to MITRE ATT&CK technique T1098, Account Manipulation. 1

Gunra's case is about VPN infrastructure, not Azure specifically. Still, it follows the same logic as Storm-0501:

• Find an identity nobody is watching.
• Make a small configuration change that passes as administration.
• Use the account's legitimate reach.

In both cases the weak point was a dormant or forgotten account, not a zero-day exploit.

The supply chain feeds the identity problem

Palo Alto Networks' Unit 42 approaches the same problem through software dependencies. Its 2026 Global Incident Response Report ranks software supply chain compromise among the leading initial access vectors into enterprise cloud environments. 2 Poisoned open-source packages let attackers bypass authentication perimeters and collect elevated cloud identity tokens, service account keys and deployment secrets from developer machines and CI/CD pipelines. 2

Unit 42 links the ChainDrop npm worm to the Shai-Hulud family. The worm infected more than 400 packages, including keyv and cacheable-request. 2 It uses a preinstall hook to download a custom Bun runtime, which runs an obfuscated credential harvester. That harvester checks files on disk and also scans the memory of running build processes for short-lived IAM keys, pipeline worker tokens and OIDC federation credentials. 2

This matters for ransomware defense. Short-lived credentials are often treated as low risk, but a harvester that reads build memory can use them before they expire. A stolen token can lead to the privilege escalation path Eon describes. 3

Reading the trend

The four sources look at different layers: aggregate attack counts, a government advisory, vendor incident research and a backup company's playbook. Their conclusions largely agree. Ransomware is not abandoning encryption, but its most damaging stages increasingly happen in identity systems that traditional endpoint tools were never built to monitor.

The practical priorities follow from that:

• Inventory and retire unused accounts.
• Require MFA on non-human identities.
• Treat directory sync servers as tier-zero assets.
• Alert on configuration changes to privileged accounts.
• Isolate backups from the identities that could delete them.

August's 12% rise is worth noting. The larger risk for defenders is a smaller number: the one unmonitored service account with Global Administrator rights.