AI fuels surge in ransomware attacks
Understand this story
Researchers have observed a surge in claimed attacks on ransomware leak sites in recent months, reaching about 3,000 in the summer, with some estimates showing 20% to 40% growth compared with spring, driven mainly by international attacks. Attackers are using large language models to optimize phishing emails and negotiation, but fully AI-driven ransomware attacks have not yet appeared, and successful groups still rely mainly on manual operations.
AI overview based on source reports · Updated 3 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIBeware the New AI-Fueled Ransomware Boom
Researchers say claimed ransomware incidents have spiked over recent months, with some estimates putting alleged attacks on leak sites at nearly 3,000 over the summer—a 20 to 40 percent increase since spring—and Halcyon's analysis counting around 111 ransomware groups making claims between July and September. Criminals appear to be using LLMs for tasks like crafting better phishing emails and negotiations rather than fully AI-powered attacks, while new smaller groups such as Global Secret Group and Storm have quickly claimed dozens of victims. Recorded Future's Allan Liska says attacks seen this year already dwarf the total for 2025, though attacks involving encryption may decrease year over year.
Activity for this story
- Current comparable activity
- 9
- Peak comparable activity
- 10Nov 15 22:00
- Change in the past 24 hours
- –
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.