An increase that is hard to measure
In recent months, ransomware attack claims published on leak sites have increased, according to researchers who track and deduplicate these data. Some estimates cited by Wired place nearly 3,000 claimed attacks over the summer, a rise of 20-40 percent compared with spring. The count remains uncertain: victims do not always report incidents, and attackers inflate their figures.
Cynthia Kaiser, former FBI deputy director for cyber and now head of research for the anti-ransomware platform Halcyon, says the newest part of the increase is international in nature: the United States remains at stable but high levels, while many more attacks are recorded abroad. According to Kaiser, this phenomenon is partly fueled by AI.
Where AI enters the attack chain
Fully automated ransomware attacks have not yet emerged. Researchers hypothesize that the criminal business model already works well without them. AI is instead used at specific stages: writing more convincing phishing emails and managing negotiations. Allan Liska, a threat intelligence analyst at Recorded Future, emphasizes that the most successful groups remain largely human-run but are experimenting intensively with AI, which could rapidly change the landscape.
Kaiser links the trend to scams in general, because attackers use similar phishing and social engineering techniques to gain initial access. She cites the case of Japan, where successful scams have increased dramatically in recent months because AI allows foreign attackers to generate convincing content in Japanese for the first time.
More groups, lone operators and fragmentation
Alongside established and stable groups such as Gentlemen, Qilin and Akira, according to Wired, smaller formations and new actors are also operating. Halcyon's analysis identifies about 111 groups that claimed attacks between July and September. Security firm ReliaQuest reports that a new group, Global Secret Group, claimed 48 victims, more than half listed on the same day, while another, Storm, listed 71 in twenty days. Not all claims may be real, but they still create uncertainty for businesses.
Brandon Tirado, director of threat research at ReliaQuest, attributes the growth to the acceleration offered by AI, which allows attackers to start their own groups rather than depend on ransomware-as-a-service providers. His team identified behind a new group an inexperienced teenager who allegedly collected more than $800,000 in less than two weeks. Kaiser considers the long-term success of these newcomers uncertain: many may emerge and then fizzle out for lack of established expertise and resources.
One possible effect concerns attack methods. Established groups typically carry out double extortion, encrypting systems and stealing data to threaten publication. Those operating alone might focus only on data extortion to simplify operations. Liska observes that the number of attacks seen by Recorded Future this year already exceeds the 2025 total, but cases involving encryption may decline compared with the previous year. The real scale of the phenomenon and the sustainability of the new groups remain to be verified.
