GenAI use by cybercriminals fuels 37% surge in ransomware attacks
Cybercriminals are increasingly using generative AI and large language models to conduct ransomware attacks, which increased 37% in 2024, according to Verizon research. Akamai reports that AI availability is enabling less-experienced attackers to mount sophisticated operations involving code writing and social engineering, while criminals employ escalating extortion tactics.
What happened
According to the 2025 Verizon Data Breach Investigations Report (DBIR), ransomware incidents increased by 37% in 2024 versus the prior year, with ransomware associated with 44% of data breaches worldwide and 54% in APAC.
Akamai's 2025 State of the Internet/Security research attributed the surge to increased availability of GenAI and Large Language Models (LLMs), which make it easier for less-seasoned cybercriminals to conduct highly effective ransomware operations by enabling them to write code and enhance social engineering methods.
Reported impact
Threat actors are using increasingly aggressive extortion tactics, including double extortion (breaching and encrypting data while demanding payment), triple extortion (adding DDoS attacks), and quadruple extortion (contacting executives, employees, partners, and media while threatening to expose regulatory non-compliance).
Index analysis
The democratisation of GenAI and the availability of AI-driven ransomware toolkits have opened the door to an increase in ransomware campaigns, with Ransomware-as-a-Service (RaaS) leveraging underground networks of developers, zero-day markets, and initial access brokers to specialise in functions like money laundering.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.