Semperis: Attackers Are Using AI Against Singapore Organisations at 1.5x the Global Rate
Reshaping Ransomware as Repeat Attacks, Threats to Employees and Their Families, and Attacks on Identity Systems Outpace Recovery Readiness
Semperis, the identity-driven cyber resilience and crisis response company, has launched its annual global ransomware report, highlighting that AI plays a significant role in the ransomware economy. Six in 10 Singapore organisations targeted by ransomware in the past 12 months said the attackers used AI, compared with 40% globally. In total, 98% said AI was involved in the attack in some way, whether on the attacker’s side, the defender’s side, or both.
The Semperis 2026 Ransomware Risk Report, found that bad actors are threatening victims with psychological intimidation in nearly 25% of all attacks in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada, and Australia.
Semperis’s Key Findings: Singapore
- Attackers are using AI at 1.5 times the global rate.
42% also said attackers manipulated or exploited an AI agent or system inside their own organisation. - Attackers increasingly threaten to victimise companies’ staff and their families.
Among organisations that were threatened, 56% reported threatening texts, letters or packages sent to home or office, and 41% reported threats against family members or friends. - AI defences help, but not consistently.
49% successfully used AI to detect or respond to the attack. 28% had AI tools in place that failed or only partly worked. - Identity systems were targeted in more than nine in 10 attacks. 92% said attackers exploited or targeted identity infrastructure, including Active Directory (52%), Entra ID (48%) and Okta (37%). The global figure is 87%.
- Business costs are high.
52% reported business disruption or revenue loss, and 47% had cyber insurance cancelled or premiums raised. 26% paid a ransom.
AI Is on Both Sides of the Attack
Looking ahead, evolving threats, including AI-based threats, were named the biggest challenge to operational resilience over the next 12 months (50%).
“Attackers are using AI against Singapore organisations more often than the global average. And the fact that attackers manipulate internal AI agents show that the risk is not limited to AI in the attackers’ hands,” said Gerry Sillars, Vice President, Asia Pacific and Japan, Semperis. “Organisations need to treat their own AI agents as part of the attack surface, with the same identity controls, permissions and monitoring as any privileged account.”
Tactics Have Shifted Since Last Year
Last year, 66% of Singapore organisations said hackers threatened to file regulatory complaints against them if incidents went unreported. This year, the most common threats were blackmail, extortion or public shaming (47%) and data erasure, destruction or release (45%), followed by system lockouts or operational sabotage (37%).
Attackers also went after staff directly. Among organisations whose attackers used threats, 14% also reported threats of abduction.
“The bad guys are always evolving their tactics,” said Mickey Bresman, Semperis CEO. “When the initial wave of ransomware attacks began, most focused on data encryption. Then, after data backup and recovery systems started gaining traction and enabling companies to resist ransom demands, we saw the double extortion: encryption coupled with data theft and threats to expose or sell that data. So, it makes sense that we’ll continue to see attackers trying to find more ways to make victims pay.”
Identity Infrastructure Continues to Be a Prime Target
Even though identity infrastructure is a prime target for threat actors, identity continues to be at risk in most organisations. In fact, 92% of ransomware attacks targeted or exploited the identity system. Only 54% of companies maintain dedicated identity backup systems; and less than half automate identity system recovery.
What Is Holding Organisations Back?
Singapore organisations cited cross-team communication gaps (49%), too many disparate tools (38%), and outdated response plans (37%) as the biggest blockers to effective crisis management and response.
Sillars added, “Organisations should back up and rehearse recovery of the identity layer as well as data and applications, and build staff safety and law-enforcement contact into their crisis plans. Regular tabletop exercises are the quickest way to find out whether the plan works and whether the teams involved can communicate under pressure.”
The full Semperis Ransomware Risk Report can be found here: https://www.semperis.com/ransomware-risk-report/.
