Beware the New AI-Fueled Ransomware Boom

Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.

The Details

With so much going on all the time, you may not have thought about ransomware and data extortion attacks in a minute, even though they’ve been among the the biggest cybersecurity threats to institutions—and, by extension, people—over the past decade. But in the new era of AI-powered and automated cyberattacks, the danger posed by ransomware is only increasing as cybercriminals profit by combining established methods with new techniques made possible or more accessible by AI.

It is difficult to determine exact numbers of ransomware attacks, given that victims don’t always disclose incidents and attackers wildly inflate their claims. But researchers who specialize in tracking and attempting to de-duplicate the field agree that claimed incidents have spiked over the last few months. Some put the number of alleged ransomware attacks on leak sites—where groups post alleged victims—at nearly 3,000 attacks over the summer. This would mean a 20 to 40 percent increase since the spring by some estimates. And, crucially, researchers emphasize that while volume always fluctuates somewhat, ransomware attacks overall have been consistently and concerningly elevated in recent years.

“What we see is most of the recent increase was fueled by international attacks; the United States was a little more steady, but still high, still a lot of attacks,” says Cynthia Kaiser, former FBI cyber deputy director who now leads research for the anti-ransomware platform Halcyon. “Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI.”

Fully AI-powered ransomware attacks have yet to emerge, perhaps because the criminal business model already works so effectively. But cybercriminals do appear to be using LLMs for some of the more mundane aspects of their attacks.

“We are seeing AI relied on more heavily in certain aspects of the ransomware attack chain, such as creating better phishing emails and in the negotiation process, but the ‘successful’ ransomware groups are still largely human operated,” says Allan Liska, a longtime ransomware researcher and threat intelligence analyst at Recorded Future. “But the fact that these groups are experimenting heavily with AI means that this could change going forward, and change quickly.”

Kaiser notes that broader trends in scamming are always relevant to ransomware, because attackers often use the same types of phishing and social engineering techniques to gain initial access to targeted systems. In Japan, for example, successful scamming has spiked drastically in recent months as AI enables foreign attackers to generate consistently convincing content in Japanese for the first time.

A few ransomware groups—namely, the Gentlemen, Qilin, and Akira—have emerged as some of the most prominent and stable operations in recent months. However, in their shadow is a range of smaller groups, emerging actors, and fragmentation of the ransomware ecosystem. In recent weeks, multiple new ransomware groups have appeared and quickly claimed to have attacked dozens of businesses. Halycon’s analysis says around 111 ransomware groups made claims of attacks between July and September this year.

One new group calling itself Global Secret Group claimed attacks on 48 victims, with more than half of these being listed on the same day, according to security firm ReliaQuest’s analysis. Another, called Storm, listed 71 victims in just 20 days. Not all of the attacks may be legitimate, but they still cause uncertainty for businesses.

“That growth has all happened because, in my eyes, this acceleration that AI has provided to these threat actors, essentially allowing for them to go out and start their own groups,” says Brandon Tirado, the director of threat research at ReliaQuest.

Instead of being beholden to traditional “ ransomware-as-a-service” providers, all of the researchers Kernel Panic spoke to say they have seen more lone-wolf operators branching out. Tirado says his team recently managed to identify who is behind one new group and found that it is being run by an inexperienced teenager who has made more than $800,000 in under two weeks. He declined to name the teen publicly.

Halcyon’s Kaiser agrees that more actors are using AI to attempt to strike out on their own with expanded capabilities to trick targets, exploit vulnerabilities, check their code, and even compromise other groups’ remote-access tools to gain redundant access to a victim in case one avenue gets blocked. But she adds that it’s still not clear how successful these upstarts will be long-term. She suspects that many of them may surge initially and then burn out, because they don’t have the institutional knowledge and expanded resources of an established group.

While established attackers typically conduct “ double extortion” attacks in which they deploy traditional ransomware that encrypts a victim’s systems while also exfiltrating a target’s data and then threatening to publish it online, those operating independently may be more likely to focus solely on data extortion to simplify their operations.

“The number of attacks that Recorded Future has seen this year already dwarfs the total number for 2025,” Liska says, “but the number of attacks involving encryption may actually decrease year over year.”

Spotted something we should include next week? Let us know at [email protected]. And stay safe out there.