AI Tools Are Accelerating the Ransomware Surge
Original: Beware the New AI-Fueled Ransomware Boom
Why This Matters
AI lowering the skill floor for ransomware signals broader, harder-to-track attack volume ahead.
Ransomware attacks spiked nearly 20–40% over summer 2026, with researchers citing AI as a key accelerant. Groups use LLMs for phishing and ransom negotiations while fully automated attacks remain absent but anticipated.
Ransomware isn't new, but it's getting worse—and AI is partly why. Researchers tracking leak sites, where criminal groups post alleged victims, counted roughly 3,000 claimed attacks over the summer of 2026, a 20–40% jump since spring. The surge is especially sharp internationally, while U.S.-targeted attacks remained elevated but steadier.
Fully AI-automated ransomware hasn't materialized yet—the existing criminal business model is already profitable enough that there's little pressure to overhaul it. Instead, attackers are selectively bolting AI onto established workflows. Recorded Future threat analyst Allan Liska notes groups are using LLMs to craft better phishing emails and assist in ransom negotiation, while core operations stay human-run. "But the fact that these groups are experimenting heavily with AI means that this could change going forward, and change quickly," Liska told WIRED.
Cynthia Kaiser, former FBI cyber deputy director and now at anti-ransomware firm Halcyon, points to Japan as a telling case study: AI is letting foreign attackers produce convincing Japanese-language scam content at scale for the first time, driving a sharp spike in successful fraud there. The same social engineering techniques feed ransomware initial-access campaigns.
Groups like Akira, Qilin, and the Gentlemen are among the more stable operations right now, but the broader field is fragmenting, with new and smaller actors filling the gaps.