Last year was a huge year for ransomware gangs. Attacks rose from 5,189 in 2024 (up 24%); however, the real number is likely to be much bigger since many pay quietly. Manufacturing hit hardest (28% of attacks); small businesses at big risk.
During 2025 malicious cybercriminals claimed thousands of victims, such as 776 attacks from the crime group Qilin. One reason for the speed and success of these attacks is artificial intelligence. AI made attacks easier with cheap malware and fake emails.
Jurgita Lapienytė, chief editor at Cybernews, has told Digital Journal that AI has supercharged ransomware gangs in 2025, and 2026 could be far worse. In terms of how AI contributes, the technology helps crooks by writing malware and creating phishing notes. Such ransomware-as-a-service approaches are sold for $400–$1,200 online.
As for 2026 outlook, Lapienytė foresees more attacks from “average” bad guys using agentic AI, plus shadow AI and layoffs leave doors open.
What the data reveals
As to the scale of attacks, Lapienytė finds that in 2024, RansomLooker, which relies on constant monitoring of criminals’ data leak sites, recorded 5,189 ransomware attacks.
Lapienytė adds: “It is important to highlight here that these are only the attacks that criminals brag about, because they are either trying to pressure those victims into paying the ransom or putting big names out there to boost their reputation. The real scope may be much, much bigger.”
How are ransomware gangs using AI?
Lapienytė finds: “AI-generated malware is a new goodie on the shelves of the dark web — yet another ready-to-use cybercrime tool that makes ransomware attacks easier, and hence more prevalent.”
Citing a prominent example, Lapienytė finds: “Anthropic discovered that criminals abused its Claude model to generate malware, which they were later selling for $400–$1,200 on dark web forums. While not the most sophisticated programs, they could still perform the most important functions, like evading discovery, encrypting files, employing anti-recovery mechanisms, and they came professionally packaged.”
In terms of threat targets, Lapienytė thinks: “Cyberattackers are increasingly going after small and medium-sized businesses, and they tend to crumble more easily. For a small family-owned entity with little to no cybersecurity resources, even the “dumbest” AI-written malware can mean the end of the business.”
Some sectors are also particularly vulnerable, Lapienytė discoveries, noting: “Manufacturing was hit the hardest last year, accounting for 28% of all ransomware attacks where the victim’s industry is known. I’d assume many cases go underreported because manufacturers are avoiding downtime costs at all times and are more likely to pay the ransoms.”
What else to expect in 2026?
As for this year, businesses need to be mindful of the threat. Lapienytė predicts: “AI or no AI, sophisticated threat actors like the ones behind Qilin and Cl0p will continue to sow terror among businesses. However, armed with AI, average crooks are about to become a big headache too.”
She also warns: “Cheaply generated malware will become more accessible, AI tools will help them craft convincing phishing campaigns, and they will be able to analyze extorted files to learn what can hurt the victim the most.”
Furthermore: “In 2026, we expect to see a rapid acceleration in ransomware cases and other AI-assisted scams for various reasons, not only because AI makes it easier to become a criminal and requires less or no technical knowledge — just motivation.”
