Ransomware attacks jump 40% as AI spawns new hacker groups

AI sharpens phishing attacks, drives summer surge

Nearly 3,000 ransomware attacks were reported this summer, a 20 to 40 percent increase since spring. The numbers come from researchers cited by WIRED, though exact counts remain uncertain—victims often refuse to report incidents, and attackers exaggerate their success. Still, cybersecurity firms tracking these trends say the spike is unmistakable, with international markets hit hardest.

The jump is tied to cybercriminals using AI. While no fully autonomous ransomware attacks have appeared yet, hackers are refining phishing emails, negotiating ransoms and automating routine tasks with large language models. Cynthia Kaiser, research lead at Halcyon, pointed to Japan, where AI-generated phishing content in Japanese has fueled a surge in successful scams.

New hacker groups appear—and disappear—faster than ever

A record 111 ransomware groups claimed attacks between July and September 2026. Many of these are new, small operations that move quickly. Global Secret Group, for example, listed 48 victims on a single day in August, while Storm racked up 71 victims in just 20 days.

These upstarts often lack the expertise or resources of established ransomware-as-a-service providers. One group, tracked by ReliaQuest, is run by a teenager who made over $800,000 in under two weeks. ReliaQuest’s director of threat research, Brandon Tirado, said AI is behind this acceleration—it lets inexperienced operators launch attacks that would have taken months or years to prepare before.

The long-term survival of these groups is far from certain. Allan Liska, a threat intelligence analyst at Recorded Future, and Halcyon’s Cynthia Kaiser both warned that many will collapse quickly. Without institutional knowledge or steady funding, they may burn out even as they create chaos for their targets.

Data extortion replaces encryption as the weapon of choice

AI is changing how these groups operate. Kaiser noted that upstart hackers now use AI to craft convincing social engineering lures, exploit software vulnerabilities, audit their own code and even hijack remote-access tools. This redundancy lets them maintain access to victims’ systems, reducing the risk of being locked out by rivals.

The shift toward AI is also changing the nature of the attacks. Recorded Future’s Liska found that while the total number of ransomware incidents has already surpassed 2025’s full-year total, fewer now include encryption. Instead, independent operators are turning to data extortion—stealing and threatening to leak sensitive data without encrypting systems at all.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

The surge in ransomware attacks, fueled by AI and the rise of inexperienced groups, is creating a more chaotic threat environment. Businesses can no longer rely on detecting known groups or tactics; they must now defend against a wider range of smaller, unpredictable attackers who may vanish as quickly as they appear.

Key takeaways

• AI is accelerating the scale and sophistication of phishing and social engineering attacks, even if fully autonomous ransomware isn’t here yet.
• Smaller ransomware groups are launching dozens of attacks within days, but many may collapse just as fast due to lack of experience or resources.
• Data extortion is becoming more common than traditional encryption-based attacks, shifting how companies need to prepare for breaches.

Related on Lazyfounder

• More technology news