Phoenix 24
Artificial intelligence is lowering barriers to cybercrime worldwide.
SAN FRANCISCO, California. Artificial intelligence is enabling inexperienced cybercriminals to establish independent ransomware operations, contributing to a sharp increase in reported attacks worldwide. Cybersecurity researchers estimate that criminal groups claimed nearly 3,000 victims during the summer of 2026, representing a rise of between 20% and 40% compared with the spring.
The findings, reported by Wired and supported by research from cybersecurity companies including Halcyon, ReliaQuest and Recorded Future, suggest that generative AI is changing how ransomware organizations recruit, operate and target businesses.
Unlike traditional ransomware groups, which often depend on experienced programmers and established criminal networks, emerging operators can use AI tools to develop phishing messages, examine software vulnerabilities, review malicious code and assist with extortion negotiations.
Cynthia Kaiser, a former senior FBI cybersecurity official who now leads threat research at Halcyon, identified a particularly pronounced increase in international ransomware activity. Her assessment suggests that AI-assisted operations may be contributing to the expansion, although their precise impact remains difficult to measure.
Between July and September, researchers identified approximately 111 groups claiming responsibility for ransomware attacks. Some newcomers rapidly published extensive victim lists, including Global Secret Group, which claimed 48 victims, and Storm, which listed 71 within 20 days.
However, these figures require caution. Cybercriminal organizations frequently exaggerate their activities, and published victim claims do not necessarily correspond to independently verified intrusions.
One particularly striking case involved an inexperienced teenager who reportedly generated more than $800,000 in less than two weeks while operating a newly established cybercrime group. The case illustrates the potential financial incentives facing young and technically inexperienced offenders.
The operational model is also changing. Instead of encrypting entire computer systems, some groups concentrate on stealing confidential information and threatening its publication unless victims pay. This approach can reduce the technical complexity of an attack while maintaining substantial financial pressure.
Despite these developments, researchers have not established the widespread existence of fully autonomous, AI-operated ransomware campaigns. Successful criminal operations remain largely directed by humans, with AI serving as an accelerator rather than an independent decision-maker.
Recent threat intelligence from Trellix reinforces the broader pattern, documenting growing fragmentation in ransomware operations and an increasing number of newly emerging groups.
For businesses and public institutions, the findings underscore the importance of strengthening identity protection, employee awareness, data backups and incident response capabilities.
The larger challenge is structural: artificial intelligence is reducing the expertise traditionally required to conduct certain cybercriminal activities, potentially expanding the number of individuals capable of threatening digital infrastructure.
As AI becomes more accessible, cybersecurity resilience will depend increasingly on anticipating threats from both established criminal organizations and rapidly emerging independent operators.
Beyond the Headlines, the Digital Security Challenge.