Beware the New AI-Fueled Ransomware Boom
Ransomware attacks have increased by 20 to 40 percent since spring, with international incidents seeing the most significant rise, as cybercriminals leverage AI to enhance their methods.
Ransomware attacks have surged by 20 to 40 percent since spring, with international incidents driving the increase, according to cybersecurity researchers. While exact numbers are difficult to track due to underreporting and inflated claims, nearly 3,000 alleged ransomware attacks were recorded on leak sites over the summer alone.
The rise comes as cybercriminals increasingly incorporate artificial intelligence into their attack methods, making existing techniques more effective and accessible. This new era of AI-powered and automated cyberattacks represents a significant evolution in the ransomware landscape that has plagued institutions and individuals for over a decade.
AI Enhances Existing Methods
While fully autonomous ransomware attacks haven't yet emerged, cybercriminals are leveraging large language models for specific aspects of their operations. AI is being used to create more convincing phishing emails and to handle negotiations with victims, though successful ransomware groups remain largely human-operated.
We are seeing AI relied on more heavily in certain aspects of the ransomware attack chain, such as creating better phishing emails and in the negotiation process, but the 'successful' ransomware groups are still largely human operated.
New Groups Emerge
The ransomware ecosystem is experiencing fragmentation with the emergence of smaller, new groups. Operations like Gentlemen, Qilin, and Akira have remained prominent, but in recent weeks, multiple new ransomware groups have appeared and quickly claimed attacks on dozens of businesses.
One new group, Global Secret Group, claimed attacks on 48 victims, with over half listed on the same day. Another, called Storm, listed 71 victims in just 20 days. Security researchers attribute this growth to AI enabling more actors to launch independent operations.
That growth has all happened because, in my eyes, this acceleration that AI has provided to these threat actors, essentially allowing for them to go out and start their own groups.
Lone-Wolf Operators Thrive
Instead of relying on traditional ransomware-as-service providers, more lone-wolf operators are branching out with AI-enhanced capabilities. Researchers have identified one new group being run by an inexperienced teenager who has reportedly made over $800,000 in under two weeks.
These independent actors may lack the institutional knowledge of established groups but benefit from AI tools that help them trick targets, exploit vulnerabilities, and gain redundant access to victims. However, experts suspect many of these upstarts may surge initially before burning out due to limited resources.
While established attackers typically conduct double extortion attacks—encrypting systems while threatening to publish stolen data—independent operators may increasingly focus solely on data extortion to simplify their operations. Some researchers predict that while total ransomware attacks will continue to increase, the number involving encryption may actually decrease year over year.
Related
