Ransomware claims have jumped since spring as AI helps lone attackers start their own groups, researchers tell Wired

A spike since spring

Ransomware and data extortion attacks are rising again, and researchers say artificial intelligence is part of the reason, Wired reported on Saturday in its security newsletter Kernel Panic. Exact numbers are hard to pin down, because victims don’t always disclose attacks and criminals inflate their claims. But researchers who track the field agree that claimed incidents have spiked in recent months: some count nearly 3,000 alleged attacks posted on leak sites over the summer, a rise of 20 to 40 percent since the spring by some estimates.

“Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI.”

Cynthia Kaiser, Halcyon, former FBI cyber deputy director, Wired

Where AI helps

Fully AI-run ransomware attacks have not appeared yet, Wired wrote, perhaps because the criminal business model already works well. Instead, attackers use large language models for the more routine steps. Allan Liska of Recorded Future told Wired that AI is used to write better phishing emails and in ransom negotiations, while the “successful” groups are still largely run by people. Kaiser pointed to Japan, where scams have risen sharply as AI lets foreign attackers write convincing Japanese for the first time.

The Gentlemen, Qilin and Akira remain the most prominent groups, but the field is fragmenting. Halcyon counted about 111 groups claiming attacks between July and September. A new group calling itself Global Secret Group claimed 48 victims, more than half of them on the same day, and another called Storm listed 71 victims in 20 days, according to the security firm ReliaQuest.

Lone wolves

All the researchers Wired spoke to said more lone operators are breaking away from “ransomware-as-a-service” providers. Brandon Tirado of ReliaQuest said his team had identified the person behind one new group: an inexperienced teenager who made more than $800,000 in under two weeks. He declined to name the teen.

Kaiser said many of the newcomers may surge and then burn out, lacking the knowledge and resources of established groups. Independent operators are also more likely to skip encryption and simply threaten to publish stolen data. Liska said the number of attacks Recorded Future has seen this year already dwarfs the total for 2025, but attacks that involve encryption may fall year on year.