AI Is Fuelling a Rise in Ransomware Attacks Worldwide
Security researchers report a sharp rise in claimed ransomware attacks in recent months. They say AI tools are partly behind it, as they let small and new criminal groups operate on their own.
.png)
Cybersecurity researchers report that the number of claimed ransomware attacks worldwide has risen markedly in recent months. Ransomware attacks are those in which criminals lock or steal an organisation's data and demand payment. According to analyses by security firms cited by the technology outlet Wired, victim lists published by criminal groups show the increase, and artificial intelligence (AI) tools are helping to drive it.
Numbers and trends
Exact figures are hard to establish: not every victim reports an incident, and attackers often inflate their claims. Some researchers counted nearly 3,000 attacks over the summer on leak sites, where groups post their alleged victims. By some estimates that is 20 to 40 percent more than in spring. Data from the firm Halcyon indicate that about 111 groups claimed attacks between July and September.
Cynthia Kaiser, a former deputy director of the FBI's cyber division who now leads research at the anti-ransomware platform Halcyon, says the latest rise has mostly come from attacks outside the United States. US figures were steadier, but still high.
How AI is changing the picture
Fully AI-driven ransomware attacks have not yet appeared, but criminals are using large language models for some stages, such as writing more convincing phishing emails and handling negotiations with victims. Allan Liska, an analyst at the security firm Recorded Future, says the most successful groups are still largely run by humans, but that heavy experimentation with AI means things could change quickly. Japan is cited as an example: scamming has jumped there in recent months because foreign attackers can now use AI to produce convincing Japanese-language content for the first time.
The most prominent groups lately are the Gentlemen, Qilin and Akira, but a range of smaller and newer groups is appearing alongside them. Global Secret Group claimed 48 victims, while Storm listed 71 in 20 days. Not all the claims may be genuine. Brandon Tirado of the security firm ReliaQuest argues that AI lets attackers start their own groups. His team found that one new group is run by an inexperienced teenager who made more than $800,000 in under two weeks.
Researchers also expect independent attackers to more often focus on data extortion alone, without encrypting systems. Liska says the number of attacks Recorded Future has seen this year already exceeds the total for all of 2025, but the number involving encryption may fall year on year.
