How cybercriminals use AI to make ransomware more effective

Ransomware continues to pose a major challenge for organisations of all sizes and sectors, as cybercriminals increasingly leverage emerging technologies and sophisticated techniques to enhance their operations.

Analysis by Comparitech found that ransomware attacks reached their highest ever quarterly volume in Q3 2026, up by 61% compared to the same period of 2025.

The increased adoption of various AI tools has enabled ransomware attackers to enhance their operations at all stages of the attack cycle. Research indicates that this adoption has contributed to the growth and effectiveness of this attack vector in a number of ways.

Cybersecurity professionals must understand how AI has changed the ransomware landscape and adjust their strategies to protect against these developments.

AI is enabling threat actors to significantly expand the scale and speed of cyber-attacks, and that includes in ransomware campaigns.

Microsoft’s Digital Defense Report 2026 highlighted that AI is compressing all aspects of the attack lifecycle, making it more challenging for defenders to detect and respond in time.

This begins with initial access, with AI models used to discover vulnerabilities in source code, binaries and AI serving systems, while social engineering campaigns such as phishing can be customised at scale.

During post compromise activity, AI has enabled attackers to shorten the data exfiltration cycle, credential discovery and lateral movement lifecycle from days to minutes, Microsoft has found.

AI has been involved in post-compromise tasks deployed by the Aurora ransomware group. Aurora has been observed deploying SpaceX’s cursor agent to assist with various exploitation activities against 10 victims between April 8 and May 26, 2026. These tasks included scanning the victim’s environment for reconnaissance purposes, installing a VPN client and running certificate attacks.

An October 2026 Cohesity study also highlighted how ransomware groups such as The Gentlemen are using AI models to speed up negotiations with victims and identifying valuable data.

AI has been used to improve the success rate of individual campaigns. This is particularly the case when AI-enhanced social engineering techniques are used for initial access.

According to a global survey of cybersecurity professionals by Proofpoint, of those organisations which have been hit by a ransomware attack, almost two-thirds (65%) said that AI increased the effectiveness of the attack.

AI tools allow cybercriminals to produce more convincing phishing emails, impersonation attacks and credential theft campaigns.

According to the Proofpoint analysis, the initial point of entry for a ransomware attack commonly involved human interaction. When respondents were asked why the ransomware attack was able to bypass their existing controls, 40% said that the initial lure appeared legitimate to the extent that the employee did not suspect anything was wrong.

Threat groups have begun using AI agents to automate parts of attack cycles or, in some cases, entire attack chains.

In July 2026, Sysdig released findings on what was thought to be the world’s first ransomware campaign completely driven by AI.

The campaign, dubbed JadePuffer, saw attack capabilities delivered by an agent rather than a human-driven toolkit and the AI was capable of working autonomously retrying failed steps within refined parameters.

The case highlights that ransomware can be carried out by AI tools rather than skilled threat actors. The researchers said that reconnaissance, credential theft, lateral movement, persistence and data destruction are achievable without any operator expertise.

Cohesity noted in its own research that the automation of significant parts of the attack chain means ransomware groups no longer require skilled teams to conduct large scale operations. This enables them to reduce costs and be more efficient.

Automated attack chains significantly reduce the barrier to entry for ransomware attackers, expanding the number of potential actors involved in this ecosystem.

AI has undoubtedly made the ransomware landscape more dangerous for organisations across all industries. Key approaches to protect against AI-driven ransomware attacks include:

• Deploy AI to match attackers’ speed. In Microsoft’s Digital Defense Report 2026, the tech giant said defenders must match the increased speed of attacks by investing in AI-driven security tools that enable them to detect and respond in real time.
• Identity controls more important than ever. AI tools used in post-compromise activities often still seek to compromise credentials and elevate privilege levels for lateral movement, enabling them to access and exfiltrate sensitive data. As such, identity and access controls need to be stronger than ever to prevent agents from moving through their systems.
• Assume compromise and build resiliency. Security teams should take a proactive approach to defence, continuously hunting for threats in their network and focusing on resiliency, including their organisation’s ability to respond and recover quickly if a ransomware attack does occur.

Enjoyed this article? Make sure to share it!

Looking for something else?