Ransomware operations are changing as criminals use AI to make parts of their work easier and as more small groups claim attacks. Researchers say the tools have not produced fully AI-run campaigns, but they may help more operators launch and sustain attacks.
Attack claims are climbing, though the count is uncertain
There is no precise tally of ransomware attacks. Victims do not always disclose incidents, and criminal groups can exaggerate claims on leak sites, where they list alleged targets. Researchers who track and deduplicate reports nevertheless say claimed incidents have risen in recent months.
Some estimates put the number of alleged attacks on leak sites at nearly 3,000 over the summer, a 20 to 40 percent increase since the spring. The overall level of ransomware activity has also stayed high in recent years, even as the volume changes over time.
Cynthia Kaiser, a former FBI cyber deputy director who leads research for Halcyon, says much of the recent increase came from international attacks. Activity in the United States was steadier, she said, but remained high. Kaiser sees AI as one factor behind the international growth.
AI is assisting parts of the attack process
Researchers have not seen ransomware campaigns that are fully powered by AI. The existing criminal business model already works, and the groups behind successful attacks remain largely human operated, according to Allan Liska, a ransomware researcher and threat intelligence analyst at Recorded Future.
AI is being used for more routine work in the attack chain. Liska says operators are using large language models to create more convincing phishing emails and help with negotiations. Those tasks can support attacks without handing control of an entire operation to an automated system.
AI-assisted scams matter because phishing and social engineering are often used to gain initial access to targeted systems. Kaiser points to Japan, where successful scamming has risen sharply in recent months as AI has allowed foreign attackers to produce convincing content in Japanese.
Smaller groups are adding to the uncertainty
The ransomware landscape includes established groups such as the Gentlemen, Qilin, and Akira, alongside newer operators and smaller crews. Halcyon analysis says around 111 groups claimed attacks between July and September this year. Some newer groups have listed large numbers of alleged victims in short periods.
Security firm ReliaQuest’s analysis says Global Secret Group claimed attacks on 48 victims, with more than half listed on the same day. Another group, Storm, listed 71 victims in just 20 days. Some claims may not be legitimate, but they can still leave businesses unsure about whether they have been targeted.
ReliaQuest threat research director Brandon Tirado attributes the growth in part to AI making it easier for threat actors to start groups. Researchers have also seen more lone operators branching out rather than relying on ransomware-as-a-service providers. Tirado described one inexperienced teenager behind a new group who made more than $800,000 in under two weeks; he declined to name the teen publicly.
More activity does not always mean more encryption
AI may help new operators trick targets, find vulnerabilities, check code, or seek another way into a victim’s systems if one route is blocked. But Kaiser says it is not yet clear whether these groups can last. New operators may see an early surge and then struggle without the experience and resources of established crews.
Their methods can also differ. Established attackers often use double extortion: they encrypt a victim’s systems, steal data, and threaten to publish it. Independent operators may focus on data extortion alone, which can simplify their operations.
Liska says the number of attacks Recorded Future has seen this year already dwarfs the total number for 2025, while attacks involving encryption may actually decrease year over year. The distinction matters: a rise in reported activity does not necessarily mean every incident follows the same playbook. For organizations, the growing number of operators and the uncertain credibility of claims make it harder to assess the threat from headline counts alone.