Ransomware incidents reported on public leak sites have reached nearly 3,000 this summer, representing a 20 to 40 percent rise since spring.
While exact figures remain impossible to verify because victims often stay silent and attackers exaggerate their claims, specialists tracking the field agree the volume has climbed. Cynthia Kaiser, former FBI cyber deputy director, notes that while the United States has seen a steady stream of attacks, the international increase is the most significant new development.
“Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI,” Kaiser says.
There are no fully autonomous AI ransomware attacks yet. The business model works well enough without them. However, criminals are using large language models for routine tasks such as drafting phishing emails and handling negotiations. Allan Liska, a threat intelligence analyst at Recorded Future, explains that while successful groups remain largely human-operated, their heavy experimentation with AI means the situation could change quickly.
Kaiser points out that broader scamming trends affect ransomware because attackers use the same phishing and social engineering techniques to gain initial entry. In Japan, for instance, successful scamming has spiked drastically in recent months as AI enables foreign attackers to generate convincing content in Japanese for the first time.
Several major groups have established themselves recently, including Gentlemen, Qilin, and Akira. Yet, these operate in the shadow of a fragmented ecosystem where smaller actors appear and disappear rapidly. Halycon’s analysis found around 111 ransomware groups claiming attacks between July and September this year.
One group calling itself Global Secret Group claimed responsibility for 48 victims, with more than half listed on the same day. Another group, Storm, listed 71 victims in just 20 days. Not all these claims are legitimate, but they create uncertainty for businesses.
“That growth has all happened because, in my eyes, this acceleration that AI has provided to these threat actors, essentially allowing for them to go out and start their own groups,” says Brandon Tirado, director of threat research at ReliaQuest.
Researchers interviewed for this newsletter report more lone-wolf operators rather than reliance on traditional ransomware-as-a-service providers. Tirado’s team recently identified one such group as being run by an inexperienced teenager who earned more than $800,000 in under two weeks. He declined to name the individual publicly.
Kaiser agrees that more actors are using AI to attempt independent operations with expanded capabilities to trick targets, exploit vulnerabilities, check their code, and even compromise remote-access tools used by other groups to gain redundant access to a victim. She adds that it is not yet clear how successful these upstarts will be long-term. She suspects many may surge initially and then burn out because they lack the institutional knowledge and resources of established groups.
While established attackers typically conduct double extortion attacks that encrypt systems and threaten to publish exfiltrated data online, independent operators may focus solely on data extortion to simplify operations.
“The number of attacks that Recorded Future has seen this year already dwarfs the total number for 2025,” Liska says, “but the number of attacks involving encryption may actually decrease year over year.”
What it means
Security teams should expect more fragmented threats from individuals using AI tools to bypass traditional barriers, rather than just facing larger, coordinated criminal syndicates.
