Ransomware attacks have experienced a notable spike over recent months, driven by international incidents and the growing use of artificial intelligence by threat actors. Researchers tracking these digital threats report that while exact numbers remain difficult to verify due to unverified claims and hidden breaches, alleged attacks posted on leak sites reached nearly 3,000 incidents over the summer months.
The Role of Artificial Intelligence
While fully autonomous AI-powered ransomware operations have not yet materialized, cybercriminals are increasingly utilizing large language models to streamline routine aspects of their attacks. According to Allan Liska, a threat intelligence analyst at Recorded Future, groups are heavily relying on AI to craft more effective phishing emails and assist in the negotiation process, though successful operations remain largely human-operated.
Cynthia Kaiser, head of research at Halcyon and former FBI cyber deputy director, as reported by WIRED, notes that broader scam trends heavily influence ransomware, as attackers frequently employ similar social engineering tactics to breach target systems initially. Kaiser points out that Japan has seen a sharp rise in successful scams as AI allows foreign malicious actors to generate consistently convincing Japanese-language content.
Rise of Independent Operators
The ransomware ecosystem has simultaneously seen the emergence of prominent groups like the Gentlemen, Qilin, and Akira alongside a vast fragmentation of smaller actors. Halcyon data indicates that approximately 111 distinct ransomware groups claimed attacks between July and September, with newcomer Global Secret Group claiming 48 victims and another group named Storm listing 71 victims in just 20 days.
Brandon Tirado, director of threat research at ReliaQuest, tells WIRED that this expansion is largely due to AI accelerating threat actors’ capabilities and enabling them to launch independent operations. Security researchers report a rise in lone-wolf operators breaking away from traditional ransomware-as-a-service models, with one new group identified as being run by an inexperienced teenager who amassed over $800,000 in less than two weeks.
Kaiser explains that these upstarts are leveraging AI to trick targets, find vulnerabilities, review code, and compromise remote-access tools. However, she adds that it remains uncertain whether these newcomers will sustain their success long-term without the institutional knowledge and resources possessed by established groups.
While established syndicates typically execute double extortion by encrypting systems and threatening to leak stolen data, independent operators may increasingly focus solely on data extortion to simplify their workflows. Liska states that the volume of attacks observed by Recorded Future this year already eclipses previous totals, even as attacks involving system encryption could potentially decline year over year.
Anyone with tips or information to share can contact the research team at [email protected].
