How to Defend Against Ransomware-as-a-Service Groups That Attack Active Directory

One year after Colonial Pipeline, Semperis' Sean Deuby on the state of infrastructure security: ransomware groups keep targeting utilities, healthcare and food supply; Gartner counts 400% more attacks; SCADA/IoT estates remain hard to secure.

Why SolarWinds should push organizations to secure AD: attackers gained initial access through on-premises AD, and AD admin access yields total on-prem and cloud visibility—continuous monitoring and layered defense are essential.

A 2022 ransomware roundup tracing the RaaS ecosystem: Hive actors alone victimized over 1,300 companies for about $100 million, while Conti and REvil morphed into affiliates like Black Basta.

Examining how ransomware tactics are escalating: attacks as decoys for espionage and destructive wipers, the rise of ransomware-as-a-service, and campaigns targeting supply chains.

The 2026 threat hierarchy: ransomware syndicates (Akira, Qilin, LockBit, DragonForce) and state-aligned APTs (Lazarus, Volt Typhoon, APT29, OilRig), with TTPs and defensive strategies.

A ransomware attack attributed to an Eastern European group forced Colonial Pipeline, supplier of nearly half the US East Coast's fuel, to shut down its entire system and triggered a federal response.