Ransomware claims near 3,000 over summer as Kaiser flags AI

Kernel Panic's survey of ransomware researchers describes a field where the established business model still works well enough that fully automated AI attacks have not been needed. Instead, the visible change is in who carries out attacks and how many claims appear. Security firm ReliaQuest found one new group, Global Secret Group, claimed 48 victims with more than half listed on the same day, while another called Storm listed 71 victims in just 20 days. Not all of those claims may be legitimate, but they still create uncertainty for businesses.

The researchers point to AI lowering the barrier for newcomers. Brandon Tirado of ReliaQuest attributes the growth of new groups to AI enabling threat actors to start their own operations rather than relying on traditional ransomware-as-a-service providers. Cynthia Kaiser of Halcyon notes that AI is used to trick targets, exploit vulnerabilities, check code, and compromise other groups' remote-access tools for redundant access. She suspects many upstarts may surge and then burn out for lack of institutional knowledge.

The shift may also change the shape of attacks. Established groups typically run double extortion, encrypting systems while also stealing data. Independently operating attackers may lean on data extortion alone to simplify. Allan Liska of Recorded Future says attacks this year already dwarf the total for 2025, but attacks involving encryption may actually decrease year over year.