A Familiar Threat With a New Accelerant
Ransomware has been a fixture of the cybersecurity conversation for the better part of a decade, hitting hospitals, schools, manufacturers, and local governments with a regularity that has numbed many people to the headlines. Yet the current moment feels different. Researchers tracking leak sites, where criminal groups post the names of alleged victims, report that claimed incidents jumped sharply over the summer, with some estimates putting the total near 3,000 attacks and a rise of 20 to 40 percent since spring. Because victims do not always come forward and attackers routinely exaggerate, these numbers are imperfect. Still, nearly every analyst agrees that the trend line is moving in the wrong direction.
What makes this wave worth watching is less the raw count and more the mechanics behind it. Artificial intelligence is not yet running ransomware campaigns from start to finish, and the most successful groups still rely heavily on human operators. But criminals are using language models to write more convincing phishing emails, to polish their negotiation messages, and to handle the tedious parts of an intrusion that once required skilled labor. Former FBI cyber deputy director Cynthia Kaiser has pointed to a notable international surge, arguing that AI is part of the reason attacks are spreading beyond the United States. In Japan, for instance, scam activity has spiked as foreign actors produce fluent, persuasive Japanese text for the first time at scale.
The Fragmentation Problem
Perhaps the most unsettling development is the breakup of the ransomware ecosystem itself. A handful of established operations, including Qilin, Akira, and the Gentlemen, still dominate the leak sites. Beneath them, however, a crowd of newer and smaller groups has appeared almost overnight. Threat intelligence firms counted around 111 groups claiming attacks between July and September alone. Some of these newcomers listed dozens of victims in a matter of days or weeks, and not every claim will hold up under scrutiny. That uncertainty is itself a weapon, forcing defenders to treat every announcement as potentially real.
Researchers describe a shift away from the traditional ransomware-as-a-service model, in which experienced developers rent their tools to affiliates. Lone operators are increasingly striking out on their own, and AI lowers the barrier to doing so. One investigation reportedly traced a fast-growing group to an inexperienced teenager who collected more than $800,000 in under two weeks. The same tools that help a veteran write cleaner code can help a novice find vulnerabilities, test malware, and build infrastructure. Analysts are divided on how durable these upstarts will be. Many may surge and fade, since they lack the institutional knowledge and resources of seasoned crews. Yet even short-lived groups can do real damage in the meantime.
What Comes Next for Defenders and Buyers
The likely long-term outcome is a more crowded and less predictable threat environment, where the question is not whether an organization will be targeted but how quickly it can detect and recover. Some experts expect a strategic change in tactics as well: smaller operators may lean more on pure data extortion, which is simpler to run than full encryption, even as the total volume of encrypted attacks could decline. For organizations, that means backups alone are no longer enough. Stolen data can be leaked without any encryption at all, which makes access controls, employee training against convincing AI-written lures, and rapid incident response plans more important than ever.
For consumers and small businesses, the rising tide of AI-assisted scams is a reminder that digital security is becoming a purchasing decision as much as a technical one. Shoppers are already weighing password managers, hardware security keys, managed backup services, and endpoint protection suites, and demand for these products tends to spike after high-profile incidents. As AI makes phishing more believable, tools that verify identity and limit damage will move from optional extras to everyday essentials. The companies that explain these protections clearly, rather than burying them in jargon, are likely to win the trust of buyers who have begun to realize that the next attack may not look like an attack at all.
