Assessing the precise scale of ransomware incidents remains challenging because victims frequently withhold disclosure and attackers routinely inflate their claims. However, researchers who specialize in tracking and de-duplicating this threat landscape agree that reported incidents have surged over the past few months. Tracking data from leak sites, where extortion groups post their alleged victims, indicates nearly 3,000 claimed attacks over the summer months. This points to a measurable 20 to 40 percent increase compared to the spring season. Crucially, security analysts emphasize that while volume always fluctuates to some degree, overall ransomware activity has remained at consistently concerning heights in recent years.
Global Surge Driven by International Threats
The recent upward trajectory is heavily driven by international attacks, marking a distinct shift in how these operations scale. Cynthia Kaiser, former FBI cyber deputy director who now heads research for the anti-ransomware platform Halcyon, notes that while the United States has remained relatively steady yet high in attack numbers, the international sphere is witnessing a massive expansion. She points to artificial intelligence as a primary catalyst behind this international acceleration. Although fully autonomous AI-driven ransomware has not yet materialized, the existing criminal business model already proves effective enough that attackers see little need to reinvent it.
LLMs Applied to Phishing and Negotiations
Despite the lack of entirely automated strains, cybercriminals are actively deploying large language models to streamline routine aspects of their operations. Allan Liska, a longtime ransomware researcher and threat intelligence analyst at Recorded Future, explains that AI is playing a heavier role in crafting superior phishing emails and assisting during the negotiation phase. While successful ransomware operations remain predominantly human-operated, heavy experimentation with artificial intelligence by these groups suggests that operational methods could evolve rapidly. This broader trend mirrors developments in general scamming, where AI allows foreign actors to generate convincing native-language content for the first time, as seen with a recent spike in successful scams in Japan.
Proliferation of Smaller Groups and Lone Wolves
While established operations like Gentlemen, Qilin, and Akira remain prominent and stable, they are now surrounded by a fragmented ecosystem of smaller actors. Halcyon analysis indicates that approximately 111 distinct ransomware groups claimed attacks between July and September. Among the new entrants, a group calling itself Global Secret Group claimed 48 victims with over half listed on a single day, according to security firm ReliaQuest. Another newcomer, Storm, listed 71 victims in just 20 days. Brandon Tirado, director of threat research at ReliaQuest, attributes this explosive growth directly to artificial intelligence, which has lowered the barrier of entry and enabled threat actors to establish independent groups.
Rather than remaining tethered to traditional ransomware-as-a-service providers, researchers note an increase in lone-wolf operators striking out on their own. Tirado reveals that his team recently unmasked one new group, discovering it was operated by an inexperienced teenager who generated over $800,000 in less than two weeks. While the teen's identity remains withheld, the case highlights the outsized capabilities now accessible to novices. Kaiser concurs that newcomers are leveraging AI to trick targets, exploit vulnerabilities, review code, and compromise remote-access tools for redundant access. However, she questions the long-term viability of these upstarts, suspecting many will burn out due to a lack of institutional knowledge and expanded resources.
Shift Toward Simplified Data Extortion
Operational tactics are also evolving alongside this structural fragmentation. While established syndicates typically deploy double extortion by encrypting systems while exfiltrating data for public leaks, independent actors are increasingly focusing solely on data extortion to streamline their activities. Liska notes that while total attack volumes tracked by Recorded Future this year already dwarf previous figures, the actual proportion of attacks involving system encryption may decline year over year as attackers lean into simpler, data-only leverage.
