In short
WIRED reports that AI is accelerating ransomware operations by helping attackers with phishing, negotiation and faster victim targeting. The threat is becoming more fragmented, with more small groups and more claims, even though human operators still run most successful campaigns.
- WIRED says ransomware claims reached nearly 3,000 over the summer.
- Researchers believe AI is helping with phishing, negotiation and faster attack setup.
- The ransomware field is fragmenting, with more small and emerging groups.
- No fully AI-powered ransomware campaign has clearly emerged yet.
AI tools are speeding up parts of the ransomware business, and researchers say the result is a broader, more fragmented wave of attacks rather than a fully automated cybercrime machine. WIRED reported on 2026-11-14 that claim volumes have risen sharply in recent months, with more new groups using AI-assisted tactics to find victims, write lures and pressure targets.
What changed in ransomware this year?
The clearest shift, according to researchers cited by WIRED, is scale. Claimed ransomware incidents on leak sites climbed to nearly 3,000 over the summer, a jump that some estimates put at roughly 20% to 40% above spring levels. That does not mean every claim reflects a distinct, confirmed intrusion, but it does suggest a busier and more aggressive ecosystem.
Researchers say AI is not replacing the people behind these operations. Instead, it is helping them move faster and sound more convincing. The main gains appear to be in phishing, negotiation and other steps in the ransomware chain where language quality, speed and persistence matter.
How is AI being used?
AI appears to be lowering some of the skills needed to run parts of an extortion campaign. WIRED’s reporting says attackers are using it to help generate convincing messages, adapt to victims more quickly and carry out other tasks that once required more manual effort or better language skills.
That matters because ransomware is not just about encryption. The modern playbook often mixes stolen data, public pressure and direct bargaining, and AI can make each of those steps easier to execute at scale.
- Phishing: generating more polished lures and fake messages
- Negotiation: helping attackers write persuasive ransom demands
- Operational speed: reducing the time needed to set up and manage attacks
- Language support: making foreign-language scams more believable
Why it matters
This trend matters because lower barriers usually mean more actors. If AI makes it easier to start a ransomware operation, the threat can spread from a relatively small set of well-known crews to a wider field of smaller and less sophisticated groups. That is exactly the pattern researchers are now describing.
The implications are especially important for companies and public institutions that already struggle with phishing and extortion. More groups mean more noise, more false leads and more opportunities for attackers to test new messages and pressure tactics. It also means defenders may face a less predictable threat surface, with new crews appearing and disappearing quickly.
There is also a regional angle. WIRED reported that Japan saw a jump in successful scams because AI made convincing Japanese-language content easier for foreign attackers to produce. That is a reminder that language barriers, which once slowed some campaigns, are becoming less effective as a defense.
Background: how ransomware became an ecosystem
Ransomware has long been more than a single strain of malware. In its classic form, it encrypts a victim’s systems and demands payment for restoration. Over time, operators added data theft, public shaming through leak sites and direct negotiation to increase pressure on victims.
One of the biggest structural changes was ransomware-as-a-service. That model lets affiliates rent tools and infrastructure from established operators, creating a kind of criminal franchise. It helped professionalize the market and spread attacks more widely long before AI became part of the conversation.
Leak sites are central to that ecosystem. They are the online spaces where attackers post victim names and claim they have stolen data. The latest figures cited by WIRED come from those claimed postings, which makes them useful as a rough threat indicator even if they are not a perfect measure of confirmed compromise.
What the numbers show
Several data points in WIRED’s reporting point in the same direction: more groups, faster posting and a more dispersed field of operators.
| Metric | What researchers reported | Why it stands out |
|---|---|---|
| Summer 2026 leak-site claims | Nearly 3,000 alleged attacks | Signals a sharp rise in posted claims |
| Estimated change vs spring | About 20% to 40% growth | Suggests momentum rather than a one-off spike |
| Halcyon tracking window | 111 ransomware groups from July through September | Points to a fragmented and crowded field |
| Global Secret Group | 48 victims claimed, with over half posted the same day | Shows how quickly new actors can flood leak sites |
| Storm | 71 victims in 20 days | Illustrates rapid, high-volume claiming behavior |
| New solo operator | More than $800,000 in under two weeks | Suggests AI may be helping inexperienced actors scale fast |
New groups, new tactics
One of the most striking changes in the reporting is the apparent fragmentation of the ransomware scene. Rather than a few dominant brands, researchers are seeing a larger number of small and emerging groups making claims.
Halcyon tracked about 111 ransomware groups making attack claims from July through September, a sign that the field is crowded and unstable. WIRED also reported the appearance of new groups such as Global Secret Group and Storm, both of which posted victims rapidly after emerging.
Global Secret Group claimed 48 victims, with more than half posted on the same day. Storm listed 71 victims in just 20 days. Those are not merely vanity figures. They show how quickly fresh actors can create the appearance of momentum, even if the underlying operations are still developing.
Researchers cited by WIRED say AI may be helping some actors start their own groups outside ransomware-as-a-service models. That is important because it changes who can enter the market. Instead of paying for access to an established criminal platform, some operators may now be able to assemble their own campaigns more independently.
How are independent operators changing the threat?
Independent operators appear more willing to rely on data extortion than encryption. That choice simplifies the attack chain: rather than spending time locking systems, they can steal data and threaten exposure. For some attackers, that may be faster, cheaper and less technically demanding.
Researchers also told WIRED that one new operator was described as an inexperienced teenager who made more than $800,000 in under two weeks. If accurate, that is a blunt illustration of how a lowered barrier to entry can produce fast profits for people who do not fit the old image of seasoned cybercriminals.
Even so, the market is not becoming fully automated. The same reporting makes clear that most successful ransomware groups remain largely human operated. AI is an accelerator, not a replacement.
“Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI.”
— Cynthia Kaiser, former FBI cyber deputy director and research lead at Halcyon
What the researchers are saying
Cynthia Kaiser’s comment captures the core concern: the rise is not only in volume, but in geography and reach. The problem is no longer confined to a single region or a handful of well-known crews. It is becoming more global, more dispersed and easier to replicate.
Allan Liska, a ransomware researcher and threat intelligence analyst at Recorded Future, said:
“We are seeing AI relied on more heavily in certain aspects of the ransomware attack chain”
That is consistent with the broader picture. The tools are improving the parts of the operation where speed and phrasing matter most, while the underlying criminal structure remains familiar.
Brandon Tirado, director of threat research at ReliaQuest, described the situation as
“that acceleration that AI has provided to these threat actors”
Recorded Future, meanwhile, has already seen more attacks this year than its total for 2025 and may see encryption-based attacks fall year over year. That would be a notable shift: fewer classic lock-and-key incidents, but not necessarily less extortion overall.
Why it matters for victims and defenders
For organizations, the practical concern is not whether the next attack is fully AI-driven. It is whether attackers can move faster, appear more credible and target more victims with less effort. If that is happening, then traditional defenses that depend on spotting awkward language or obvious mistakes may become less reliable.
There is also a strategic risk in the rise of more independent operators. Small crews can be harder to track, less predictable in their methods and more willing to experiment. They may not have the discipline or infrastructure of larger syndicates, but they can still inflict damage and force companies into costly response efforts.
For law enforcement and intelligence teams, the fragmentation cuts both ways. More groups create more opportunities to detect patterns, but they also create more clutter. When dozens of names appear on leak sites in a short period, separating real operational growth from inflated boasting becomes harder.
How much of the spike is real?
That is one of the biggest unanswered questions. The numbers cited by WIRED are based on claimed attacks, often posted to leak sites, so they may include exaggeration, recycled claims or duplicate reporting. Still, researchers say the overall direction is hard to ignore.
The open question is how much of the recent rise reflects actual intrusions versus a more aggressive culture of posting. Even if some of the increase is noise, the appearance of more groups and more claims can still shape the threat environment, because it affects how victims, insurers and defenders assess risk.
Another question is whether AI will eventually make a fully automated ransomware campaign possible. For now, the answer appears to be no. WIRED’s reporting says no fully AI-powered ransomware campaign has clearly emerged, and the most successful groups remain human run.
What happens next?
The next phase to watch is whether the current wave of smaller operators can sustain themselves. Some may burn out quickly after a brief burst of activity. Others may mature into more durable groups, especially if AI continues to reduce the amount of expertise needed to participate.
Researchers will also be watching the balance between encryption-heavy attacks and data-only extortion. Recorded Future’s view that encryption-based attacks may fall year over year suggests the market could keep shifting toward simpler, faster pressure tactics.
Key developments to watch include:
- Whether the summer’s nearly 3,000 claimed attacks are followed by another high-volume quarter.
- Whether more new groups appear with short, intense posting sprees like Storm and Global Secret Group.
- Whether AI makes foreign-language scam content even more effective in regions such as Japan.
- Whether defenders see a decline in encryption-heavy ransomware as data extortion becomes more common.
The bottom line from the latest reporting is not that AI has taken over ransomware. It is that AI is helping more people get into the business, and that may be changing the shape of the threat faster than the tools themselves are evolving.
Frequently asked questions
How is AI being used in ransomware attacks?
AI is being used to help with phishing, negotiation and other parts of the ransomware chain. Researchers cited by WIRED say it is making attackers faster and more convincing, especially when they need to write messages or operate across languages.
Has AI created fully automated ransomware?
No, not yet. WIRED reports that no fully AI-powered ransomware campaign has clearly emerged, and most successful ransomware groups still appear to be largely human operated.
Why are ransomware claims increasing?
Researchers say claimed attacks have risen because more groups are entering the field and using AI-assisted tactics. Nearly 3,000 alleged attacks were posted on leak sites over the summer, suggesting a busier and more fragmented ecosystem.
What is changing about ransomware groups?
The field is fragmenting into more small and emerging groups. Halcyon tracked about 111 ransomware groups making claims from July through September, while new groups like Global Secret Group and Storm posted victims rapidly after appearing.
