AI-Powered Ransomware: How Threat Actors Weaponize AI Across the Attack Lifecycle

The SANS Stay Ahead of Ransomware livestream kicked off 2026 with an in-depth exploration of how cybercriminals are leveraging artificial intelligence to enhance ransomware and cyber extortion operations. Hosted by Ryan Chapman and Mari DeGrazia, the episode provided insights into the evolving threat landscape.

What Is AI-Powered Ransomware? How Artificial Intelligence Lowers the Barrier for Cybercrime

AI-Powered ransomware refers to ransomeware attacks enhanced by artificial intelligence to automate, personalize, and accelerate each stage of the attack lifecycle. AI lowers the barrier for cybercriminals by enabling even low-skilled attackers to generate phishing emails, write malicious code, analyze stolen data, and negotiate ransoms using AI-driven chatbots—dramatically reducing the time, effort, and expertise required to launch sophisticated campaigns.

2025 Ransomware in Review: Trends in AI-Powered Ransomware Attacks

Ryan began by reviewing last year’s trends from Coveware's 2025 ransomware report. While ransomware payment amounts showed some volatility, spiking in Q2 2025 before declining, the overall trend indicates victims are paying less frequently, though amounts remain substantial when payments do occur.

Notably, remote access has reemerged as a primary attack vector. Phishing remains prevalent, while newer techniques like ClickFix and FileFix are gaining traction as initial access methods.

According to statistics from ecrime.ch, ransomware actors posted 7,819 incidents to data leak sites in 2025. The United States was most heavily targeted, with nearly 4,000 incidents. Canada (400+), Germany (292), the United Kingdom (248), and Italy (167) rounded out the top five targeted nations. Leading ransomware groups included Qilin, Akira, Cl0p, PLAY, and SAFEPAY.

AI's Role in Lowering Barriers to Entry

A key theme throughout the discussion was how AI has dramatically lowered the technical barriers for cybercriminals. Mari introduced the concepts of "vibe coding" and "vibe hacking,” where threat actors use AI to generate malicious code with minimal programming knowledge. As she explained, attackers can simply prompt an AI model to create code, then iteratively refine it by feeding errors back into the AI for fixes.

How AI Is Used in Ransomware: From Phishing to Extortion

Initial Access: AI-Powered Phishing and the Rise of Autonomous Ransomware Tactics

The most dramatic AI-driven increase has been in phishing attacks, with SentinelOne reporting a staggering 1,265% growth in AI-powered phishing attempts. Mari outlined the "four pillars of phishing with Generative AI":

1. Data Analysis: AI conducts reconnaissance on targets, gathering personal and organizational information
2. Personalization: Crafting highly targeted messages based on collected intelligence
3. Content Creation: AI generates grammatically correct, convincing emails in multiple languages
4. Scale and Automation: Mass-producing personalized campaigns at unprecedented speeds

During a live demonstration, Mari showed how easily an open-source AI model (DeepSeek) could research a target and generate a sophisticated phishing email in minutes, complete with industry-specific details and personalized elements.

Exploiting CVEs with AI: Common Vulnerabilities Targeted by AI-Driven Ransomeware

Ryan highlighted how AI systems can now generate working exploits for CVEs within 10-15 minutes of publication. These systems scan vulnerability databases, analyze GitHub repositories for proof-of-concept code, and even reverse-engineer security patches to identify exploitable flaws. The HexStrike AI framework illustrates this capability, combining multiple AI agents to automate penetration testing and exploitation.

Lateral Movement with AI: Machine Learning in Credential Theft and Ransomware Spread

An August 2025 report by Anthropic documented cases where threat actors used “real-time assistance” from AI during network reconnaissance. AI helped identify critical systems like domain controllers and SQL servers while extracting credentials throughout the attack chain.

Data Exfiltration and Analysis

Perhaps most concerning is AI's ability to rapidly analyze exfiltrated data. Tasks that once required dedicated "data warehouse managers" within ransomware groups can now be accomplished by AI in hours rather than weeks. AI can automatically identify and categorize sensitive information like social security numbers, financial records, and personal data, then craft tailored extortion notes listing specific compromised assets.

Negotiation and Communication

AI-powered chatbots are now being used to handle ransom negotiations, eliminating language barriers and time zone delays. This allows threat actors to engage victims in English (or other languages) 24/7, maintaining consistent pressure throughout the negotiation process.

Learning More and Looking Forward

To learn more about these topics, we recommend that you watch the January 6, 2026 episode of the SANS Stay Ahead of Ransomware livestream.

Next month's episode will feature Raymond DePalma from Palo Alto Networks Unit 42, who will discuss how organizations can use AI to defend against these evolving threats.

Join us on the first Tuesday of each month at 1:00 PM Eastern (10:00 AM Pacific) for the SANS Stay Ahead of Ransomware livestream. You can also review the SANS Stay Ahead of Ransomware livestream playlist on YouTube.

Remember to check out our upcoming SANS training events, including FOR528: Ransomware and Cyber Extortion and FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models, where we dive into the technical details of preventing, detecting, and responding to modern ransomware and cyber extortion attacks.

Continued Reading

AI Security Training Starts Here

LDR516: Strategic Vulnerability and Threat Management

How to Integrate AI into Modern SOC Workflows