AI-Powered Ransomware: How Threat Actors Weaponize AI Across the Attack Lifecycle

The SANS Stay Ahead of Ransomware livestream kicked off 2026 with an in-depth exploration of how cybercriminals are leveraging artificial intelligence to enhance ransomware and cyber extortion operations. Hosted by Ryan Chapman and Mari DeGrazia, the episode provided insights into the evolving threat landscape.

2025 Ransomware in Review

Ryan began by reviewing last year’s trends from Coveware's 2025 ransomware report. While ransomware payment amounts showed some volatility, spiking in Q2 2025 before declining, the overall trend indicates victims are paying less frequently, though amounts remain substantial when payments do occur.

Notably, remote access has reemerged as a primary attack vector. Phishing remains prevalent, while newer techniques like ClickFix and FileFix are gaining traction as initial access methods.

According to statistics from ecrime.ch, ransomware actors posted 7,819 incidents to data leak sites in 2025. The United States was most heavily targeted, with nearly 4,000 incidents. Canada (400+), Germany (292), the United Kingdom (248), and Italy (167) rounded out the top five targeted nations. Leading ransomware groups included Qilin, Akira, Cl0p, PLAY, and SAFEPAY.

AI's Role in Lowering Barriers to Entry

A key theme throughout the discussion was how AI has dramatically lowered the technical barriers for cybercriminals. Mari introduced the concepts of "vibe coding" and "vibe hacking,” where threat actors use AI to generate malicious code with minimal programming knowledge. As she explained, attackers can simply prompt an AI model to create code, then iteratively refine it by feeding errors back into the AI for fixes.

AI Across the Attack Lifecycle

Initial Access and Phishing

The most dramatic AI-driven increase has been in phishing attacks, with SentinelOne reporting a staggering 1,265% growth in AI-powered phishing attempts. Mari outlined the "four pillars of phishing with Generative AI":

1. Data Analysis: AI conducts reconnaissance on targets, gathering personal and organizational information
2. Personalization: Crafting highly targeted messages based on collected intelligence
3. Content Creation: AI generates grammatically correct, convincing emails in multiple languages
4. Scale and Automation: Mass-producing personalized campaigns at unprecedented speeds

During a live demonstration, Mari showed how easily an open-source AI model (DeepSeek) could research a target and generate a sophisticated phishing email in minutes, complete with industry-specific details and personalized elements.

Vulnerability Exploitation

Ryan highlighted how AI systems can now generate working exploits for CVEs within 10-15 minutes of publication. These systems scan vulnerability databases, analyze GitHub repositories for proof-of-concept code, and even reverse-engineer security patches to identify exploitable flaws. The HexStrike AI framework illustrates this capability, combining multiple AI agents to automate penetration testing and exploitation.

Lateral Movement and Credential Harvesting

An August 2025 report by Anthropic documented cases where threat actors used “real-time assistance” from AI during network reconnaissance. AI helped identify critical systems like domain controllers and SQL servers while extracting credentials throughout the attack chain.

Data Exfiltration and Analysis

Perhaps most concerning is AI's ability to rapidly analyze exfiltrated data. Tasks that once required dedicated "data warehouse managers" within ransomware groups can now be accomplished by AI in hours rather than weeks. AI can automatically identify and categorize sensitive information like social security numbers, financial records, and personal data, then craft tailored extortion notes listing specific compromised assets.

Negotiation and Communication

AI-powered chatbots are now being used to handle ransom negotiations, eliminating language barriers and time zone delays. This allows threat actors to engage victims in English (or other languages) 24/7, maintaining consistent pressure throughout the negotiation process.

Learning More and Looking Forward

To learn more about these topics, we recommend that you watch the January 6, 2026 episode of the SANS Stay Ahead of Ransomware livestream.

Next month's episode will feature Raymond DePalma from Palo Alto Networks Unit 42, who will discuss how organizations can use AI to defend against these evolving threats.

Join us on the first Tuesday of each month at 1:00 PM Eastern (10:00 AM Pacific) for the SANS Stay Ahead of Ransomware livestream. You can also review the SANS Stay Ahead of Ransomware livestream playlist on YouTube.

Remember to check out our upcoming SANS training events, including FOR528: Ransomware and Cyber Extortion and FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models, where we dive into the technical details of preventing, detecting, and responding to modern ransomware and cyber extortion attacks.