AI linked to 84% of ransomware attacks, new report finds

Cybercriminals exploited artificial intelligence in ransomware attacks experienced by 84% of surveyed victims, according to a sweeping new global cybersecurity report, while 44% reported that attackers exploited their own AI systems.

But the findings also underscored ransomware's human toll. According to the report, more than a third of surveyed victims faced psychological or physical threats against employees, and 14% of surveyed organizations even reported employees or family members forced to change jobs, office locations or residences as a result of sustained ransomware threats.

For Chris Inglis, former White House National Cyber Director under former President Joe Biden, artificial intelligence represents a turning point in the capabilities ripe for cybercriminals' exploit —and he warns that a particularly consequential development is already underway: autonomous ransomware attacks.

The cybersecurity expert and Semperis board member previously spent three decades watching technologies mature at the National Security Agency watching as attacks required substantially less direct human involvement – no longer simply a theoretical possibility.

"AI is an inflection point in their capacities to hold the same things at risk," Inglis said. He later added, "I think we're already seeing autonomous attacks. Autonomous ransomware attacks are included in the mix."

"We have democratized AI to the point where even low level models can allow that to happen," Inglis said, noting that the technology compounds the number of criminals capable of launching more technical attacks, while inviting experienced cybercriminals to penetrate networks more efficiently and on a much greater scale.

For years, criminals have relied on a familiar playbook: exploiting vulnerabilities, penetrating corporate networks, encrypting data and demanding a ransom payment in exchange for restored access or withholding sensitive information. Now, in more than eight out of 10 attacks, AI has been incorporated into that process.

AI has also enabled attackers to quickly identify weaknesses, tailor social engineering schemes to specific employees, automate an intrusion and readjust tactics as defenders try to react, according to Inglis.

By lowering technical barriers, AI risks enabling a wider range of actors to attempt intrusions that previously demanded a wide swath of resources and more specialized training or know-how.

"We're starting to see more attacks with more rapid development, and attribution of these attacks will be more difficult for law enforcement," Bar says in the report.

Courtney Guss, Semperis's associate vice president of crisis management, warns that autonomous AI agents can create security risks when they seek additional permissions or interact with sensitive corporate systems.

"That's just how they operate. AI agents typically try to accomplish their assigned tasks by any means they can." Guss continued. "One way they can gain more ability to operate in the environment is by getting permissions to other systems. The fastest path to get those permissions is to compromise your identity system, which effectively puts the agent into 'god mode,' enabling it to grant itself whichever permissions it needs to accomplish its task. Unfortunately, the agent then becomes a ticking time bomb."