Cybercriminals Deploy Artificial Intelligence in 84% of Ransomware Attacks, New Report Finds
HOBOKEN, N.J. — Cybercriminals are increasingly weaponizing artificial intelligence to amplify the scale, speed, and precision of ransomware operations, according to findings from the 2026 Ransomware Risk Report published by identity-driven cybersecurity firm Semperis.
The report—which polled 1,200 IT and security executives across nine nations and eight primary industry sectors—revealed that 84% of organizations hit by ransomware reported attackers exploited AI during the breach. Furthermore, 44% of victimized organizations stated that extortionists compromised or manipulated their own internal AI systems to facilitate the intrusion or move laterally across corporate networks.
Escalating Sophistication and the Dual Use of AI
The findings paint an evolved picture of modern cybercriminal enterprise, where threat actors utilize generative tools, automated reconnaissance algorithms, and AI-driven social engineering to bypass legacy defenses:
- Attacker Innovation: Cybercriminals leverage AI to generate evasive malware code, craft highly personalized spear-phishing campaigns, and identify vulnerable perimeter assets faster than security teams can patch them.
- Exploitation of Corporate AI Infrastructure: As enterprises rapidly deploy internal AI models and data pipelines, attackers are weaponizing these assets against their hosts. In 44% of incidents, threat actors breached corporate AI models or data repositories to steal intellectual property, extract credentials, or corrupt training datasets.
- Identity Systems as Primary Targets: The report highlighted that 87% of ransomware incidents targeted corporate identity infrastructure, such as Active Directory, Entra ID, and Okta. Despite this vulnerability, only about half of surveyed organizations maintain specialized, automated recovery tools tailored specifically for identity environments.
Evolving Extortion Tactics and Physical Intimidation
The integration of artificial intelligence coincides with a sharp escalation in aggressive extortion techniques aimed at forcing payout compliance.
Semperis reported that 40% of ransomware incidents involved direct psychological or physical threats against company executives, staff members, or their families. Threat actors frequently followed through on these pressure tactics, carrying out harassment campaigns, “swatting” calls to employee residences, or releasing sensitive personal information when initial ransom demands were refused.
In addition, the report noted that repeat victimisation remains rampant, with nearly 70% of compromised firms targeted in multiple attack cycles and 31% paying ransoms more than once.
Industry Call for Adaptive Defense Frameworks
Cybersecurity experts contend that the widespread adoption of AI tools by adversary groups renders annual penetration testing and traditional endpoint protection insufficient on their own.
“The bad guys are always evolving their tactics,” stated Mickey Bresman, Chief Executive Officer at Semperis. “Attackers first focused on data encryption, then added data theft and threats to expose or sell the data, and will keep looking for more ways to make victims pay.”
Security analysts urge enterprise CISOs to prioritize identity system resilience, deploy AI-driven real-time threat detection, and establish dedicated crisis management protocols that account for both digital asset recovery and the physical safety of personnel.
Cybersecurity-Picture-on-Wikimedia-by-MST-Malhy-Soft-Technologies.
