Researchers link rise in ransomware claims to criminals' growing use of AI

Claimed ransomware attacks have climbed over recent months, and security researchers tie part of the increase to criminals using artificial intelligence, WIRED reported in its Kernel Panic newsletter. The analysts quoted say AI is lowering the barrier for new actors and speeding up familiar attack methods.

Exact figures are hard to establish, since victims do not always disclose incidents and attackers often exaggerate their claims. Even so, researchers who track and de-duplicate the data agree that claims have spiked. Some count nearly 3,000 alleged attacks posted on leak sites over the summer, which would be a 20 to 40 percent increase from spring by some estimates. Researchers also stress that attack levels have been consistently high for several years.

Cynthia Kaiser, a former FBI cyber deputy director who now leads research at the anti-ransomware platform Halcyon, said much of the recent growth came from attacks outside the United States, where activity was steadier but still high. She said she believes this is partly driven by AI. In Japan, she noted, scamming has surged because AI lets foreign attackers produce convincing Japanese text for the first time.

Fully AI-powered ransomware has not appeared yet, perhaps because the existing criminal business model already works well. Allan Liska of Recorded Future said AI is being used more in parts of the attack chain, such as writing better phishing emails and handling negotiations. He added that successful groups are still largely run by humans, but that heavy experimentation with AI means this could change quickly.

Groups called the Gentlemen, Qilin and Akira have been among the most prominent and stable operations lately. Around them, the ecosystem is fragmenting. Halcyon's analysis found about 111 ransomware groups claimed attacks between July and September. According to ReliaQuest, a new group calling itself Global Secret Group claimed 48 victims, more than half listed on a single day, while another called Storm listed 71 victims in 20 days. Not every claim may be genuine, but they still create uncertainty for businesses.

Brandon Tirado, director of threat research at ReliaQuest, said AI has accelerated this growth by enabling actors to start their own groups. The researchers interviewed said they are seeing more lone operators rather than reliance on traditional ransomware-as-a-service providers. Tirado said his team identified the person behind one new group as an inexperienced teenager who earned more than $800,000 in under two weeks. He declined to name the individual.

Kaiser said newcomers are using AI to trick targets, exploit vulnerabilities, check code and even compromise other groups' remote-access tools to keep backup access to a victim. It is unclear how long these upstarts will last, and she suspects many will surge and then burn out without the experience and resources of established gangs.

Independent actors may also lean toward pure data extortion instead of the double extortion approach, which combines encryption with threats to publish stolen data. Liska said Recorded Future has already seen more attacks this year than in all of 2025, but the number involving encryption may fall year over year.