AI Is Raising the Ransomware Threat, Even Without Full Automation

Ransomware is not yet an autonomous criminal machine. But artificial intelligence is beginning to make established extortion operations easier to run, potentially widening the pool of attackers and increasing the speed and polish of some parts of an attack.

That is the central warning from ransomware researchers cited by Wired: fully AI-powered ransomware campaigns have not emerged, but criminals appear to be applying large language models to routine tasks including drafting phishing messages and supporting negotiations with victims. The shift matters because ransomware already poses a persistent risk to institutions, businesses and the people whose data those organizations hold.

Higher claimed attack volumes

Measuring ransomware precisely is difficult. Victims do not always make attacks public, while criminal groups can exaggerate their activity. Researchers tracking the ecosystem therefore have to distinguish between claims posted on attackers’ leak sites and confirmed incidents.

Even with that caveat, researchers told Wired that claimed incidents rose in recent months. Some estimates put the number of alleged attacks posted to leak sites at nearly 3,000 over the summer, representing an increase of roughly 20% to 40% from the spring. The figures should not be treated as a complete count of successful attacks, but they add to concern that ransomware activity remains elevated.

Cynthia Kaiser, a former FBI cyber deputy director who leads research at anti-ransomware platform Halcyon, said the more notable recent growth was international. The United States was described as comparatively steadier, though still at a high level of attacks. That distinction suggests the problem is not simply a short-lived spike in one market; it may reflect a broader expansion of criminal operations.

AI is changing parts of the attack chain

Ransomware gangs do not need AI to encrypt systems or demand payment. Their business model has been profitable for years, and many successful groups remain human-operated. The immediate effect of generative AI is more likely to be incremental: improving tasks that once required more time, language skills or specialized knowledge.

Phishing is a clear example. A better-written fraudulent email can be more convincing, particularly when an attacker needs to tailor messages to a target organization or write in a language they do not speak well. Negotiation is another. Extortion groups frequently communicate with victims during a ransomware incident, and AI tools could help them draft, translate or vary those messages.

Allan Liska, a threat intelligence analyst at Recorded Future, told Wired that researchers are seeing more AI use in those areas. He also stressed that successful ransomware groups are still largely run by people. That is an important limit on claims that AI has already created a new era of fully automated cybercrime.

Why incremental gains can still matter

The distinction between assistance and automation should not create complacency. A technology does not need to replace criminals entirely to alter the risk. If it reduces the effort required to create credible phishing lures or communicate across borders, it can help existing groups operate more efficiently and make lower-skill actors more capable.

The reported experimentation is also significant because ransomware groups can adopt useful tools quickly. Researchers quoted by Wired said the groups’ heavy experimentation with AI could change the situation rapidly, even if autonomous campaigns have not materialized.

For organizations, the practical takeaway is to focus on defenses that remain valuable regardless of whether an attacker uses AI. Staff need support in recognizing suspicious requests; access should be limited so one compromised account cannot expose an entire network; and incident-response planning should assume that attackers may try both to disrupt operations and to steal data for extortion.

The current evidence does not support treating every ransomware incident as an AI attack. It does support treating AI as an emerging capability layer on top of a mature criminal problem. The danger is less a science-fiction scenario of malware acting alone than a near-term reality in which human attackers can communicate, adapt and scale more easily.

A threat that remains human-led

Ransomware’s most consequential feature is still its human decision-making: selecting victims, gaining access, setting demands and exploiting pressure during negotiations. AI may streamline pieces of that process, but it has not displaced the operators behind it.

That nuance is essential. It keeps attention on the evidence while acknowledging why the trend deserves scrutiny. Claimed ransomware activity is already high, international attacks appear to be rising, and threat actors are testing AI in practical ways. The next phase may not arrive as fully automated ransomware overnight. It may arrive as many small improvements that make a familiar threat harder to contain.

This article is based on reporting by Wired. Read the original article.