Spet

Artificial intelligence is reshaping cybersecurity on both sides of the battlefield. While organizations are increasingly adopting AI to strengthen their defenses, cybercriminals are using the same technology to launch faster, more sophisticated ransomware attacks that outpace traditional security measures. According to CrowdStrike’s 2025 State of Ransomware Survey, 76% of organizations say they struggle to keep up with AI-powered threats, and nearly 90% believe AI-driven protection is now essential.

According to the Global Cybersecurity Outlook 2026 survey, 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk in 2025. Looking ahead, data leaks associated with generative AI (34%) and the advancement of adversarial capabilities (29%) are the leading concerns for 2026. This represents a notable shift from 2025, when adversarial capabilities ranked first at 47%, compared with just 22% for genAI-related data leaks. The change signals a turning point in the AI risk landscape: while the AI arms race between attackers and defenders continues, growing attention is shifting from offensive AI capabilities toward the unintended exposure and misuse of sensitive data through generative and agentic systems.

The findings highlight a growing reality for businesses: as attackers continue to weaponize AI to automate and accelerate every stage of an attack, the question is no longer whether AI belongs in cybersecurity, it’s whether defenders can gain the advantage before adversaries do.

AI is Reshaping the Ransomware Threat Landscape

The 2025 Ransomware Survey conducted by CrowdStrike gathered responses from more than 1,000 IT and cybersecurity decision-makers across multiple countries. The findings highlighted a broad range of concerns, with the growing impact of AI emerging as a key theme.

Artificial intelligence is accelerating the sophistication and speed of ransomware attacks, with 76% of organizations reporting that it is becoming increasingly difficult to prepare as attackers use AI to evade traditional defenses. Social engineering has emerged as one of the greatest concerns: 82% believe AI-generated phishing emails are harder to detect, even for well-trained employees, and 87% say AI-powered social engineering is more convincing than traditional tactics. Looking ahead, 87% also expect deepfake audio and video to become major attack vectors, highlighting that employee awareness training alone may no longer be sufficient to counter evolving threats.

Organizations are also struggling to keep pace operationally. Nearly half worry they cannot detect and respond to AI-driven attacks quickly enough, while 85% believe traditional detection methods are becoming obsolete. Although AI adoption among defenders is increasing, implementation remains uneven: a little over half of organizations currently use AI-powered threat detection, with lower adoption in sectors such as the public sector. Concerns also vary across regions and industries, but the overall trend is consistent: AI is transforming ransomware into a faster, more adaptive threat that requires equally advanced, AI-enabled security capabilities.

How Cybercriminals are Using AI

One of the clearest examples is the explosion of AI-powered phishing. SentinelOne reports a 1,265% increase in AI-assisted phishing attacks, highlighting how generative AI has become a force multiplier for ransomware operators. Rather than sending generic spam, attackers can now build highly personalized campaigns at scale by using AI to:

• Analyze publicly available information about individuals and organizations
• Generate tailored phishing messages based on a target’s role, industry, or recent activity
• Produce polished, grammatically accurate emails in multiple languages
• Launch thousands of personalized campaigns with minimal manual effort

The result is phishing that is both more convincing and significantly easier to scale, increasing the likelihood of attackers obtaining the credentials or initial foothold needed to deploy ransomware.

AI is also shrinking the window between vulnerability disclosure and active exploitation. Security researchers have demonstrated that AI can generate working proof-of-concept exploits for newly disclosed vulnerabilities in as little as 10 to 15 minutes after a CVE is published. AI models can rapidly analyze vulnerability databases, review public proof-of-concept code, compare software patches to identify exploitable weaknesses, and produce exploit code that attackers can adapt for real-world use.

Cybercriminals are using AI to accelerate malware development by generating new variants with customized features that are more difficult for traditional security tools to detect. Rather than creating malware entirely from scratch, generative AI is particularly effective at rewriting, modifying, and obfuscating existing malicious code, allowing attackers to rapidly produce thousands of unique variants that can bypass signature-based defenses. AI also enables attackers to analyze source code and identify vulnerabilities more quickly, helping them tailor malware for specific environments after gaining initial access. In addition, AI-powered tools lower the technical barrier for cybercriminals by assisting with tasks such as generating ransomware scripts, phishing kits, and password-cracking techniques. Together, these capabilities allow ransomware operators to launch attacks faster, evade detection more effectively, and continuously adapt their malware to defensive measures.

JadePuffer: The First Fully Autonomous AI-Powered Ransomware Attack

Recent research from Sysdig highlights a significant shift in the ransomware landscape with the discovery of JadePuffer, an operation that appears to have been executed entirely by an autonomous large language model (LLM) agent. Rather than relying on a human operator, the AI agent independently carried out every stage of the attack, from initial reconnaissance and credential theft to lateral movement, privilege escalation, persistence, and ultimately data encryption. It gained initial access by exploiting CVE-2025-3248, a remote code execution vulnerability in Langflow, an open-source framework for building LLM applications. Throughout the intrusion, the agent demonstrated the ability to adapt when its actions failed, modifying its approach and refining its tactics until it achieved its objective. Although the individual techniques used were already well known, JadePuffer showed that AI can autonomously orchestrate the complete ransomware lifecycle without direct human involvement.

The significance of JadePuffer extends well beyond automation; it challenges many of the assumptions underlying modern cyber defense. Looking ahead, JadePuffer should be viewed as a proof of concept for a new generation of ransomware. As AI-powered attack frameworks mature, they are likely to lower the technical barrier for threat actors, enable attacks against multiple organizations simultaneously, and create increasingly adaptive ransomware campaigns that can outpace traditional, human-driven detection and response processes.

Conclusion

Traditional security controls such as multi-factor authentication prompts, alert thresholds, and incident response workflows are largely designed around the assumption of a human adversary who can be slowed by friction, fatigue, or error. Autonomous AI agents challenge that assumption by operating at machine speed, rapidly working around obstacles and potentially reducing the time from initial compromise to ransomware deployment to minutes. Their ability to continuously adapt to defensive measures may further reduce the effectiveness of static controls, while AI-generated payloads could complicate signature-based detection by dynamically modifying their characteristics during an attack. At the same time, recovery mechanisms may shift from being secondary targets to primary objectives as attackers seek to disrupt an organization’s ability to restore operations.

The findings from GuidePoint Security’s Q2 2026 report highlight several ransomware trends being observed this year, including continued growth in ransomware activity, the emergence of AI as a tool to improve threat actor efficiency, and the persistence of manufacturing as a frequently targeted sector. While the threat landscape continues to evolve, these trends underscore the importance of maintaining strong cybersecurity fundamentals, regularly assessing risk, and preparing for increasingly sophisticated extortion tactics.

Curious to learn more? Contact us.