Claimed ransomware incidents rose this summer as some attackers used generative AI for phishing and negotiations, researchers told Wired, though fully automated ransomware has not yet appeared¹.

It is hard to pin down exact counts because victims do not always disclose incidents and attackers inflate claims, Wired reported¹. Researchers who try to de-duplicate leak-site listings put alleged attacks near 3,000 over the summer, which some estimates treat as a 20 to 40 percent increase since spring¹.

Cynthia Kaiser, a former FBI cyber deputy director who now leads research at anti-ransomware firm Halcyon, said most of the recent increase was fueled by international attacks while U.S. volume was steadier but still high¹. "Internationally we're seeing a lot more attacks," Kaiser said, adding that she thinks AI is part of it¹.

Allan Liska, a threat intelligence analyst at Recorded Future, said AI is being used more in phishing emails and in the negotiation process¹. "The 'successful' ransomware groups are still largely human operated," Liska told Wired¹. He said heavy experimentation with AI could change that quickly¹.

Kaiser said scamming trends matter because ransomware crews often use the same phishing techniques for initial access¹. Wired cited Japan, where researchers say AI has helped foreign attackers generate convincing Japanese-language content¹.

Gentlemen, Qilin, and Akira have been among the more prominent operations recently, Wired reported, while many smaller groups have appeared¹. Halcyon analysis put about 111 ransomware groups claiming attacks between July and September¹. ReliaQuest said a group calling itself Global Secret Group claimed 48 victims, more than half listed the same day, and another called Storm listed 71 victims in 20 days¹. Not all claims may be legitimate¹.

Brandon Tirado, ReliaQuest's director of threat research, attributed the growth of new groups in part to AI letting operators start on their own instead of relying on ransomware-as-a-service providers¹. Tirado said his team identified one new group as run by an inexperienced teenager who made more than $800,000 in under two weeks; he declined to name the person publicly¹.

Kaiser said more actors are using AI to trick targets, check code, and even hijack other groups' remote-access tools, but she is unsure how durable the upstarts will be¹. Independents may lean on data extortion without encryption, Wired reported¹. Liska said Recorded Future has already seen more attacks this year than in all of 2025, while encryption-related attacks may fall year over year¹.