Security
Ransomware attacks surge as AI tools lower barriers for attackers
Companies face mounting pressure to pay ransoms as criminal groups adopt AI-powered methods and attack targets accelerate.
Ars Technica
Around half of organizations hit by ransomware attacks opt to pay the criminals' demands, research from Sophos indicates, with the ransoms themselves growing larger. The trend is forcing governments and security experts to confront a growing dilemma: how to respond when traditional defenses fail.
Government crackdown#
The UK is taking an aggressive stance, drafting rules that would prevent public-sector bodies and infrastructure operators—hospitals, local authorities, schools—from paying attackers. The move reflects wider concern that ransom payments fuel the criminal ecosystem and embolden further attacks.
The sophistication explosion#
Ransomware operations have transformed into highly organized criminal enterprises that operate like legitimate businesses, says Haydn Brooks, chief executive at Risk Ledger. This professionalization, combined with AI-powered hacking tools like WormGPT and FraudGPT, is reshaping the threat landscape.
The numbers tell the story: confirmed ransomware victims jumped 389 percent year-over-year in 2025, reaching 7,831 globally compared to around 1,600 in 2024. The speed has also multiplied—attackers can now target four organizations in the time it once took to compromise a single target.
The economics of attack vs. defense#
The real breakthrough for criminals is economic. AI tools have slashed the cost of launching sophisticated attacks, making ransomware accessible to less-skilled operators. Meanwhile, organizations face rising defense costs.
"What required nation states earlier can be accomplished by individuals with half-baked skills leveraging the power of AI," says Shashi Kiran, chief marketing officer at Nile. Small and medium-sized businesses are particularly vulnerable to this approach, bearing the brunt of the commoditized attack strategy.
The combination of legal risks from paying ransoms, mounting recovery costs, and the sheer volume of attacks is forcing companies into agonizing choices with no easy answers.
