Ransomware Groups Lean on AI Tools as Attack Claims Climb Worldwide

Ransomware operators are not yet running fully automated attacks, but researchers tracking leak sites say criminal groups are already folding AI tools into specific steps of the attack chain, and that claimed incidents jumped sharply over the summer, according to WIRED.

How are ransomware groups actually using AI right now?

The mechanism is narrower than full automation. "We are seeing AI relied on more heavily in certain aspects of the ransomware attack chain, such as creating better phishing emails and in the negotiation process, but the 'successful' ransomware groups are still largely human operated," said Allan Liska, a threat intelligence analyst at Recorded Future, per WIRED. In practice, that means large language models are drafting more convincing lure emails to win initial access to a network and helping operators script ransom negotiations with victims — not independently selecting targets, breaching systems, or deploying encryption payloads end to end.

Has ransomware volume actually increased, and by how much?

Exact counts are hard to verify because victims do not always disclose incidents and attacker groups routinely inflate their claims, WIRED reports. Still, researchers who track leak sites — where groups post alleged victims publicly — put the total near 3,000 claimed attacks over the summer, which some estimates place at a 20 to 40 percent increase since spring. Analysts caution that ransomware activity has stayed elevated for years regardless of short-term swings, so the summer spike sits on top of an already high baseline rather than marking a new phenomenon.

Why is the increase concentrated outside the United States?

Cynthia Kaiser, former FBI cyber deputy director and now head of research at the anti-ransomware platform Halcyon, told WIRED the recent growth is largely international. "What we see is most of the recent increase was fueled by international attacks; the United States was a little more steady, but still high, still a lot of attacks," Kaiser said. "Internationally we're seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI."

Kaiser pointed to Japan as a case study: scam activity there has risen as AI lets foreign attackers generate convincing Japanese-language phishing content for the first time, WIRED reports — the same social-engineering playbook ransomware crews use to gain initial network access.

Which groups are driving the current wave?

WIRED names the Gentlemen, Qilin, and Akira as the most prominent and stable ransomware operations in recent months. Beneath them sits a more fragmented layer of smaller and newer groups; several fresh ransomware brands have surfaced in recent weeks, according to the outlet.

Will ransomware attacks become fully automated?

Not yet, researchers say, in part because the existing human-run extortion model already turns a profit. But Liska warned that is not fixed: "The fact that these groups are experimenting heavily with AI means that this could change going forward, and change quickly." For now, the practical takeaway for defenders is narrower than headlines suggest — AI is sharpening the phishing lures and negotiation scripts that already work, while the breach, encryption, and extortion operations behind them remain run by people.

AlterEgo — A keyboard for character voices. Five free persona rewrites a day.