.png)
New ransomware groups are using AI to launch independent, rapid-fire attacks, with 111 groups claiming victims between July and September this year.
This surge moves away from established ransomware-as-a-service models toward lone-wolf operators using automated tools to exploit vulnerabilities and manage data extortion.
The traditional hierarchy of cybercrime is fracturing. While established operations like the Gentlemen, Qilin, and Akira maintain stability, a shadow ecosystem of smaller, highly volatile groups is emerging. These actors are no longer strictly beholden to large-scale providers; instead, they are using artificial intelligence to build their own infrastructure.
“That growth has all happened because, in my eyes, this acceleration that AI has provided to these threat actors, essentially allowing for them to go out and start their own groups,” said Brandon Tirado, the director of threat research at ReliaQuest.
This technological democratization allows even inexperienced players to execute sophisticated campaigns. In one recent instance, a single new group managed to generate more than $800,000 in under two weeks. ReliaQuest researchers identified the operator as an inexperienced teenager, though his identity remains undisclosed.
As the number of independent actors rises, the technical methodology of their attacks is evolving. Established groups typically employ "double extortion," a process where they both encrypt a victim's systems and exfiltrate sensitive data to force payment. However, the new wave of AI-fueled upstarts is pivoting toward a leaner model.
To simplify operations, many independent operators are focusing solely on data extortion. By skipping the complex process of system encryption, they reduce the technical overhead and the risk of detection during the deployment phase. This shift is reflected in recent activity metrics.
According to Liska, the total number of attacks seen by Recorded Future this year already dwarfs the total number for 2025. However, the specific subset of attacks involving encryption may actually decrease year over year.
The speed at which these new entities claim victims highlights how volatile the market is. Some groups appear and vanish almost as quickly as they are identified.
| Ransomware Group | Reported Victims | Timeframe |
|---|---|---|
| Global Secret Group | 48 | Single day peak |
| Storm | 71 | 20 days |
The utility of AI for these new actors extends beyond simple automation. Halcyon’s Kaiser notes that attackers are using these tools to expand their operational capabilities in several specific areas:
- Deception: Using AI-generated content to trick targets during the initial access phase.
- Vulnerability Research: Automating the process of finding and exploiting software flaws.
- Code Auditing: Checking their own malicious code for errors that might trigger security alerts.
- Redundant Access: Compromising the remote-access tools of other groups to ensure they maintain a foothold even if one entry point is blocked.
Despite these expanded capabilities, the long-term viability of these “upstart” groups remains uncertain. Kaiser suggests that many of these actors may experience an initial surge in activity only to burn out quickly, as they lack the institutional knowledge and the deep resource pools held by veteran cybercriminal organizations.
The market is defined by this tension between the massive scale of AI-enabled automation and the lack of professionalized stability found in traditional ransomware syndicates.
