Cybersecurity researchers are tracking a significant increase in ransomware incidents, driven largely by the integration of artificial intelligence into criminal operations. While fully automated AI ransomware has not yet emerged, threat actors are increasingly relying on large language models to streamline the most tedious parts of their campaigns. This shift has lowered the barrier to entry, allowing a new wave of independent operators to launch attacks with greater speed and sophistication.
International Spike in Attack Volume
Exact figures for ransomware incidents are difficult to verify because victims often remain silent and attackers frequently exaggerate their success. However, analysts who track and de-duplicate these events note a clear upward trend. Over the summer, alleged ransomware attacks posted on data leak sites reached nearly 3,000, representing a 20 to 40 percent increase compared to the spring.
Cynthia Kaiser, former FBI cyber deputy director and now head of research at Halcyon, highlighted that the surge is not uniform across all regions. She noted that while attack levels in the United States have remained high but steady, international targets are seeing a dramatic rise.
“What we see is most of the recent increase was fueled by international attacks,” Kaiser said. “Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI.”
The use of AI is particularly evident in social engineering. In Japan, for example, foreign attackers have begun generating highly convincing phishing content in Japanese, a language barrier that previously limited the scope of such scams. This capability allows criminals to target organizations in non-English speaking markets with the same precision they apply to Western targets.
Fragmentation and New Actor Emergence
The ransomware landscape is also becoming more fragmented. While established groups like Gentlemen, Qilin, and Akira continue to operate, a flood of smaller, new groups has appeared. Halcyon data indicates that approximately 111 distinct ransomware groups claimed attacks between July and September. Some of these new entities have moved with alarming speed. The Global Secret Group claimed 48 victims, listing more than half on the same day. Another group named Storm listed 71 victims in just 20 days.
Brandon Tirado, director of threat research at ReliaQuest, attributes this fragmentation to AI acceleration. He argues that AI tools allow threat actors to start their own groups with expanded capabilities, reducing reliance on traditional ransomware-as-a-service providers.
Tirado’s team recently identified the operator behind one new group as an inexperienced teenager who generated over $800,000 in less than two weeks. This case illustrates how AI lowers the technical skills required to run a profitable cybercrime operation.
Allan Liska, a threat intelligence analyst at Recorded Future, confirmed that while successful groups remain largely human-operated, the experimentation with AI is changing the attack chain. He noted that AI is heavily used for creating phishing emails and managing negotiations. However, he warned that the landscape could change quickly as these groups refine their automated tools.
Not all new groups will survive. Kaiser suspects that many will surge initially and then burn out due to a lack of institutional knowledge and resources. Unlike established syndicates, these lone-wolf operators often lack the long-term strategy needed to sustain operations against improved defenses.
Shift Toward Data Extortion
As the ecosystem diversifies, the nature of the attacks is also evolving. Traditional ransomware groups typically use double extortion, encrypting data and threatening to publish stolen information. Newer, less resourced groups may skip encryption to simplify their operations, focusing solely on data theft and extortion.
Liska pointed out that while the total number of ransomware attacks this year dwarfs the total for 2025, the number of attacks involving actual encryption may decrease year over year. This shift suggests that criminals are prioritizing speed and volume over the complex technical execution of encryption, relying on AI to handle the initial access and data exfiltration phases.
The rise of AI-fueled ransomware attacks presents a persistent challenge for global security. As tools become more accessible, the volume of incidents is likely to remain elevated, requiring organizations to strengthen their defenses against both sophisticated syndicates and inexperienced but well-equipped lone actors.
Source: Wired
