AI-driven ransomware attacks surge globally with automated social engineering
Ransomware groups are increasingly using AI tools to automate and scale attacks, including social engineering, code generation, and malware development. AI-driven attacks in 2025 have targeted critical sectors and resulted in significant data breaches, with defenders struggling to keep pace with the accelerating threat.
What happened
TRM Labs identified nine emerging ransomware groups including Arkana Security, Dire Wolf, Frag, and Sarcoma that extensively use AI in their operations. These groups leverage AI to automate social engineering attacks, write messages, and create deepfake videos that are increasingly believable.
AI enables ransomware attackers to automate the intrusion, encryption, and extortion stages of attacks. Large language models are used to automate code generation and create personalised phishing messages, lowering barriers to entry for attackers. AI-driven ransomware can automatically scan system vulnerabilities, modify its actions to avoid detection, and proliferate within networks.
Polymorphic malware enabled by AI changes with each infection, making detection more difficult. According to MIT Sloan and Safe Security, 80% of ransomware attacks in 2025 are based on AI systems facilitating advanced phishing, deepfaking, and automated password cracking.
Reported impact
AI transformation of ransomware operations enables massively scaled attacks with faster operations and more sophisticated social engineering. Ransomware groups are deploying new tactics that rely on regulatory and reputational pressure instead of encryption.
Tata Technologies suffered a major ransomware breach in 2025 involving 1.4TB of stolen data and ransom demands. According to Industrial Cyber Security Analytics, nearly half of all ransomware incidents in 2025 have targeted critical industries such as healthcare, energy, and manufacturing, disrupting essential operations.
Index analysis
According to Palo Alto Networks, companies are not coping well with rapid changes in ransomware tactics where AI facilitates quick compromise and shortens the time available to detect and respond. The combination of automation and intelligence forces defenders to rethink and update their approach to detection and response.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.