AI Tools Fueling a Surge in Ransomware Attacks

Ransomware attacks are experiencing a significant increase as cybercriminals combine traditional methods with new techniques enabled by artificial intelligence (AI). This trend poses a growing threat to institutions and individuals alike, as the danger of data extortion escalates.

While exact statistics on ransomware incidents are challenging to ascertain due to underreporting by victims and inflated claims by attackers, researchers indicate that reported incidents have surged in recent months. Some estimates suggest nearly 3,000 alleged ransomware attacks occurred over the summer, representing a 20 to 40 percent increase since spring. Researchers highlight that ransomware attacks have remained consistently elevated in recent years.

Cynthia Kaiser, former FBI cyber deputy director and current head of research at the anti-ransomware platform Halcyon, notes that a significant portion of the recent increase in attacks is driven by international incidents. She states, “Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI.”

Despite the absence of fully AI-driven ransomware attacks, cybercriminals are increasingly utilizing LLMs for various aspects of their operations. Allan Liska, a ransomware researcher at Recorded Future, explains that AI is being used to enhance phishing emails and facilitate negotiations, although successful ransomware groups remain predominantly human-operated. He warns that the experimentation with AI by these groups could lead to rapid changes in the future.

Kaiser emphasizes that trends in scamming are relevant to ransomware, as attackers often employ similar phishing and social engineering techniques to gain access to targeted systems. In Japan, for instance, there has been a notable rise in successful scams, aided by AI’s ability to generate convincing content in Japanese.

Several ransomware groups, including Gentlemen, Qilin, and Akira, have emerged as prominent players in recent months. However, the landscape is also marked by numerous smaller groups and new entrants. Halcyon reports that around 111 ransomware groups claimed attacks between July and September this year, with some new groups, such as Global Secret Group and Storm, quickly claiming multiple victims.

Brandon Tirado, director of threat research at ReliaQuest, attributes the growth of these groups to the acceleration provided by AI, allowing more individuals to establish their own operations. He cites a case where a teenager, inexperienced in cybercrime, managed to generate over $800,000 in just two weeks.

Kaiser concurs that more actors are leveraging AI to enhance their capabilities, including tricking targets and exploiting vulnerabilities. However, she cautions that the long-term success of these new entrants remains uncertain, as they may lack the resources and knowledge of established groups.

Established attackers often employ double extortion tactics, encrypting victims’ systems while also exfiltrating data and threatening to publish it. In contrast, independent operators may focus solely on data extortion to streamline their operations. Liska notes that while the total number of attacks this year has already surpassed 2025 figures, the number involving encryption may decline.

Source: WIRED