AI is fueling ransomware growth and helping new groups emerge

Rising attacks and AI’s role

It is difficult to establish the exact number of attacks: victims do not always report incidents, and criminals may exaggerate their claims. Still, researchers who track these cases and try to remove duplicates have noted a sharp rise in claims in recent months. Some estimates put the number of attack claims posted on leak sites over the summer at nearly 3,000, up 20–40% from the spring. Overall, however, attack levels have remained high for several years.

Cynthia Kaiser, a former FBI deputy assistant director for cybersecurity who now leads research at Halcyon, says attacks outside the US account for most of the recent increase. Their number in the United States itself was more stable, but remained high. Kaiser sees the spread of attacks abroad as a new development and links it in part to AI.

No fully AI-driven ransomware attacks have been identified so far. Researchers say criminals may not need them: the existing model is already working. But they use language models for specific tasks, such as writing convincing phishing emails and negotiating with victims.

Allan Liska, a ransomware researcher and cyber threat analyst at Recorded Future, says the most successful groups are still largely run by people. But criminals are actively experimenting with AI, and that could change quickly.

AI is also helping with fraud, which often serves as the first step in an attack on an organization: attackers use phishing and social engineering to gain access to systems. In Japan, successful fraud attacks have risen sharply in recent months. For the first time, AI has enabled foreign criminals to regularly create convincing material in Japanese.

New groups and independent operators

Researchers count Gentlemen, Qilin and Akira among the most prominent and persistent groups of recent months. At the same time, the number of smaller, newer outfits is growing, and the ecosystem is fragmenting. Halcyon’s analysis found that about 111 groups claimed attacks between July and September this year.

Not every claimed attack necessarily happened, but such reports create uncertainty for companies. Brandon Tirado, director of cyber threat research at ReliaQuest, links the growing number of groups to AI speeding up criminals’ work and enabling them to start their own operations.

Researchers are also seeing more solo operators who might previously have depended on ransomware-as-a-service providers. Tirado’s team recently identified the person behind one new group: an inexperienced teenager who made more than $800,000 in less than two weeks. Tirado did not publicly identify him.

Kaiser of Halcyon says AI expands what newcomers can do. They can use it to deceive victims, find vulnerabilities, test code and even hack other groups’ remote-access tools to keep a backup way into a system. But it is still unclear whether new operators can establish themselves for the long term. Kaiser expects many to gain momentum quickly, then stop: they lack the experience and resources of long-running groups.

How the extortion model is changing

Established groups often use double extortion: they encrypt a victim’s systems, steal data and threaten to publish it online. Independent operators may simplify the process and demand money to keep stolen data private, without encrypting systems.

Liska says Recorded Future has already recorded more attacks this year than in all of 2025. At the same time, the number of incidents involving data encryption may fall year over year.

Dataist’s take: AI is not yet replacing people in attacks, but it is lowering the barrier to starting new criminal groups and helping them take on different stages of extortion. A rise in claims does not mean a rise in confirmed incidents: some attacks may be exaggerated or unreliable. Nor does a short-term increase in newcomers’ capabilities mean these groups can compete with experienced operators over the long term.