Beware the New AI-Fueled Ransomware Boom

Ransomware attacks have climbed sharply over the past few months, with trackers putting claimed incidents on leak sites at nearly 3,000 over the summer — an estimated 20 to 40 percent rise since spring. Researchers caution that victims often stay quiet and attackers inflate their numbers, but agree that attack volume has remained persistently elevated in recent years.

The growth is increasingly international rather than domestic. Cynthia Kaiser, former FBI cyber deputy director who now leads research at Halcyon, said the recent uptick was largely fueled by attacks abroad, with U.S. activity steadier but still high, and she attributed part of that pattern to AI. Fully AI-driven ransomware has yet to appear — the criminal business model already works well enough — but LLMs are being folded into pieces of the attack chain. Recorded Future analyst Allan Liska said AI shows up most in crafting phishing emails and in ransom negotiations, while leading groups remain human-operated, though heavy experimentation could change that quickly.

The landscape is also fragmenting. Halcyon counted around 111 ransomware groups making attack claims between July and September. Alongside established players like Gentlemen, Qilin, and Akira, newcomers are appearing fast: ReliaQuest analysis found Global Secret Group claimed 48 victims, more than half listed on a single day, while a group called Storm listed 71 victims in 20 days. Not every claim is legitimate, but the noise itself creates uncertainty for defenders.

AI is also enabling lone operators to skip ransomware-as-a-service intermediaries. ReliaQuest's Brandon Tirado said AI-driven acceleration lets actors spin up their own groups; his team traced one new operation to an inexperienced teenager who made more than $800,000 in under two weeks. Kaiser said independent actors use AI to expand their reach — tricking targets, checking exploit code, even hijacking rival groups' remote-access tools for redundant entry — while expecting many to surge and then burn out for lack of institutional knowledge. Lone operators also lean toward pure data extortion rather than the double-extortion encryption-plus-leak model used by bigger groups.

AI's role in scams is spilling into ransomware, since both rely on the same phishing and social-engineering entry points; in Japan, scamming has spiked as AI lets foreign attackers produce convincing Japanese-language content for the first time. What to watch: whether human-run groups automate more of the chain, whether the flood of new, inexperienced operators produces durable threats or short-lived noise, and how much of the leak-site volume reflects real compromise.

keyFacts

whyItMatters

llmSnippet