AI Accelerates Human-Led Ransomware Attacks
Generative AI is not replacing human hackers but is accelerating ransomware attacks by lowering the required skill level and barrier to entry, according to a new report from Securin. The 2025 Ransomware Report finds that while AI boosts participation, strategic control of these cyberattacks remains in human hands.
- Generative AI is used by attackers to automate reconnaissance, create highly personalized and realistic phishing emails, and develop malware that can adapt to evade detection. - The use of AI-powered tools has dramatically increased the speed of attacks, with the "breakout time" — the time from initial access to lateral movement — dropping from 48 minutes in 2024 to just 18 minutes in mid-2025. - A common tactic amplified by automation is "double extortion," where attackers first steal a victim's data and then encrypt it, threatening to leak the stolen information publicly if the ransom is not paid. - Prominent ransomware groups in 2024 and 2025 include RansomHub, which emerged as a leader after the disruption of other major players, as well as Akira, Qilin, and Cl0p, known for targeting critical infrastructure and exploiting zero-day vulnerabilities. - The Ransomware-as-a-Service (RaaS) model, which operates like a subscription service for cybercrime, is being supercharged by AI, making it easier for less skilled criminals to launch sophisticated attacks. - AI has led to a 1,265% increase in AI-powered phishing attempts, which are used to gain initial access to networks for ransomware deployment. - After stealing data, attackers are using AI to rapidly analyze it, identifying the most sensitive information like financial records and personal data to create tailored extortion notes. - While attackers leverage AI, defensive cybersecurity is also being enhanced by it; AI-powered tools can help detect unusual network behavior, predict potential threats, and automate incident response.
