Ransomware attacks have risen sharply in recent months, with researchers who track the field agreeing that claimed incidents have spiked, according to an analysis of leak-site data. Some estimates put alleged attacks posted on leak sites at nearly 3,000 over the summer, a 20 to 40 percent increase since the spring by some counts. Researchers caution that exact figures are elusive because victims do not always disclose incidents and attackers inflate their claims, but they say overall ransomware activity has remained consistently elevated in recent years.
Cynthia Kaiser, former FBI cyber deputy director who now leads research at the anti-ransomware platform Halcyon, said the recent increase was driven mostly by international attacks while the United States stayed steadier but still high. She attributed the international surge in part to AI. Fully AI-powered ransomware attacks have yet to appear, possibly because the criminal business model already works well, but attackers are using large language models for tasks such as writing better phishing emails and handling negotiations, according to Allan Liska, a longtime ransomware researcher and threat intelligence analyst at Recorded Future. Liska said successful ransomware groups remain largely human operated, though heavy experimentation with AI could change that quickly.
Kaiser noted that scamming trends matter to ransomware because attackers use the same phishing and social engineering techniques to gain initial access. In Japan, successful scamming has risen drastically in recent months as AI lets foreign attackers produce convincing Japanese content for the first time.
A few groups, namely the Gentlemen, Qilin, and Akira, have emerged as prominent and stable operations, but smaller and emerging actors are fragmenting the ecosystem. Halcyon's analysis counted around 111 ransomware groups making claims between July and September. ReliaQuest's analysis found one new group, Global Secret Group, claimed 48 victims, more than half listed on the same day, while another, Storm, listed 71 victims in 20 days. Not all claims may be legitimate, but they still create uncertainty for businesses.
Brandon Tirado, director of threat research at ReliaQuest, said the growth stems from AI accelerating threat actors and letting them start their own groups. Researchers told Kernel Panic they have seen more lone-wolf operators instead of reliance on traditional ransomware-as-a-service providers. Tirado said his team identified one new group run by an inexperienced teenager who made more than $800,000 in under two weeks; he declined to name the teen.
Kaiser said more actors are using AI to strike out on their own, with capabilities to trick targets, exploit vulnerabilities, check code, and compromise other groups' remote-access tools for redundant access. She said it is unclear how successful these upstarts will be long-term and suspects many may surge and then burn out. Established attackers typically conduct double extortion, encrypting systems while exfiltrating data and threatening to publish it, while independent operators may focus solely on data extortion. Liska said attacks Recorded Future has seen this year already dwarf the total for 2025, though attacks involving encryption may actually decrease year over year.
More cybersecurity news from TechManNews.
