AI tools appear to be helping less experienced criminals enter the ransomware business, even though researchers have not yet seen fully automated ransomware operations. WIRED reports that attackers are using language models to improve phishing, translate scams, assist with code and handle parts of extortion negotiations.
Researchers tracking leak sites counted nearly 3,000 claimed incidents over the summer, an estimated 20% to 40% increase from the spring. Those figures are uncertain because victims do not always disclose attacks and criminal groups exaggerate their activity, but multiple specialists describe ransomware volume as persistently high.
The ecosystem is also fragmenting. Halcyon observed roughly 111 groups making claims from July through September, while ReliaQuest identified new operations that listed dozens of alleged victims in a short period. One inexperienced teenage operator identified by researchers reportedly earned more than $800,000 in under two weeks.
Established groups still rely heavily on people and often combine encryption with stolen-data threats. Smaller operators may simplify their work by using data extortion alone. The immediate risk is therefore not an autonomous attack system, but AI making established techniques cheaper, faster and usable across language barriers. Some newcomers may burn out quickly, yet the lower entry cost creates more attempts for defenders to handle.