From Cameo To Lead Role: AI Takes Over Ransomware

Etay Maor is Vice President of Threat Intelligence for Cato Networks, a converged network and security cloud for the AI era.

getty​As much as 48% of breaches involve ransomware, and AI is making it more effective. While AI has certainly made malware smarter, it has also enabled unskilled actors to run attacks that were once the domain of highly trained threat actors.

AI has essentially democratized the ransomware attack vector.

Most ransomware today is available as ransomware-as-a-service (RaaS) kits. There is a core group that builds the malware and manages the leak site that publishes stolen data. Affiliates carry out the attack and pay the core group a share of the ransom they collect.

From the perspective of the affiliate, getting into the network is the first step, but the real work comes afterward. It involves figuring out the network structure, identifying the systems that are attack-worthy and ensuring they stay hidden long enough to deploy the encryptor that locks the victim’s files. This process takes days or even weeks of hands-on work. Ransomware negotiation is also a manual effort, typically involving an individual who might or might not have a real sense of what the data is actually worth.

Not every affiliate is a master at launching a successful ransomware attack. They work on a limited number of victims at a time. While defenders can pat themselves on the back for deflecting an attempted attack, many times, their defenses appear better than they actually were because the attack was conducted by amateurs.

Last year, the number of active ransomware groups rose 49%, according to IBM. Part of the reason is AI, which lets attackers automate processes that used to take skill and time. Affiliates see AI as a great leveler to fill in the missing know-how that can help accelerate attacks at scale.

1. The Sales Pitch: Ransomware services are giving center stage to AI in their ads to woo affiliates. Some of the lofty claims made in these advertisements can’t be confirmed, but they do give us an indication of which way the wind is blowing. Affiliates want AI tools, and this isn’t just empty talk. A group handed its ransomware negotiations to an AI chatbot, which meant victims were pressured to pay around the clock instead of only when a human negotiator was available.

2. The Dependable Assistant: Ransomware threat actors recently used a widely available AI coding tool that enabled them to break into at least six organizations. Instead of doing each step manually, the AI did much of the work inside the network, including ranking databases by how much they would be worth in an extortion demand.

3. Inside The Product: Some newer RaaS kits go a step further. Their control panels are run by an LLM, which sellers say can perform multiple actions including scanning infected machines, keeping track of several victims simultaneously and writing ransom notes. Of course, buyers haven’t confirmed any of these features yet, but if this turnkey kit works as advertised, an affiliate doesn’t need much experience to manage it.

The kind of work that originally took days can now be done in hours. Security teams don’t have much time to spot an attack before it can cause extensive damage.

AI tools can also run several attacks at once and reply to victims in their own language at any hour. A typical setup these days involves AI handling the first contact, followed by a human joining the party in cases of large ransomware amounts.

Finally, RaaS services are cheap, with some selling for as low as $40 per month. The cost of launching AI attacks at scale is not prohibitive anymore.

A two-pronged approach will help security teams defend against these growing threats.

First, look for signs of AI in attacks. AI-written attack code often gives itself away, with long step-by-step comments and plain-English notes left inside scripts. Another warning sign is a server program that has no reason to use AI suddenly connecting to an AI service. Such traffic should be investigated.

Second, improve your ability to recover. Many AI tools used for ransomware focus on stopping victims from restoring their data. This is why you must:

• Keep backups offline, in a form that can’t be changed or deleted.

• Test restores regularly, not just backups.

• Alert immediately when anyone tries to delete backups.

• Patch internet-facing systems quickly.

AI has turned ransomware from a specialized craft into a mass-market commodity. By filling in the missing skills for amateurs, AI lets them strike with the scale and precision of elite attackers, shrinking defensive response windows from days to hours.

Because these automated attacks move too fast for traditional prevention to keep up, protecting the business comes down to proactive threat hunting and regularly tested recovery plans. We can’t just focus on building taller walls; survival hinges on how fast teams can bounce back when a strike happens.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?