Topic starter
14/09/2026 10:09 am
TL;DR: Ransomware moved in 2026 from AI as marketing to AI as an assistant and then into AI built into ransomware, with four of eleven new RaaS operations advertising AI features and documented cases of autonomous attack actions, according to Cato Networks. The security issue is no longer just faster malware, but cheaper access to competent intrusion workflows that can be scaled by less skilled operators.
Editorial analysis by NHI Mgmt Group, based on content published by Cato Networks: “Ransomware’s AI Adoption Curve: From Marketing Claim to Operating Model”.
By the numbers:
- Dark-web posts about criminal AI tooling are surging from dozens a month in 2025 to hundreds a month in 2026.
- A separate case saw 600+ attack actions executed autonomously, with no human involved.
Key questions
Q: What breaks when ransomware can run autonomously on AI?
A: Traditional detection and response workflows break because they assume the attacker needs time to operate manually.
Q: Why do service accounts make AI-assisted ransomware harder to stop?
A: Service accounts often hold the exact credentials and permissions an attacker needs to move quickly once inside.
Q: How can security teams tell whether ransomware activity is being assisted by AI?
A: Look for rapid task completion, verbose or unnatural script comments, repeated self-correction, and outbound connections to model or automation endpoints from processes that normally should not use them.
Practitioner guidance
- Harden service-account recovery paths Monitor and restrict workflows that allow service account password recovery, reset, or reuse during incident response and administration.
- Detect AI-shaped intrusion bursts Alert on rapid sequences of shell activity, directory changes, hidden account creation, and privilege escalation that occur faster than normal operator pacing.
- Block model and automation endpoints from servers Investigate unexpected outbound traffic to model APIs or automation services from non-browser processes on internal systems.
Bottom line: Ransomware is evolving from a manual intrusion model into a delegated operating model, which lowers the skill required to run a credible attack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
AI has moved ransomware from a craft model to an operating model. The important change is not just faster malware, but the delegation of attack work that used to require a skilled operator. That changes how defenders should think about the attack economy, because capability is now being packaged for lower-skill affiliates. The practitioner conclusion is simple: resilience planning must assume competent attack workflows will be more available than before.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do differently when ransomware is treated as an operating model?
A: Assume the attacker can scale competent intrusion steps across many victims and time zones with less human effort. That means resilience, recovery testing, backup immutability, and identity telemetry have to be treated as frontline controls, not post-breach cleanup. The goal is to make the campaign expensive to finish, even if access is achieved.
👉 Read our full editorial: AI is turning ransomware into an operating model