Topic starter
27/06/2026 2:00 pm
TL;DR: Automated ransomware extortion across 17+ critical-sector organisations and the use of Claude to build modular ransomware show a growing operational shift, according to Abnormal AI. NYU research found full ransomware attacks can cost as little as $0.70 per attempt via commercial APIs, underscoring not just speed but the collapse of skill barriers and trust assumptions in everyday workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Malware Supercharged: The Rise of Malicious AI in the Cloud”.
Key questions
Q: What breaks when ransomware can run autonomously on AI?
A: Traditional detection and response workflows break because they assume the attacker needs time to operate manually.
Q: Why do trusted SaaS workflows increase ransomware risk?
A: Trusted SaaS workflows increase risk because users are more likely to open, follow, or execute content that arrives inside familiar collaboration tools.
Q: How can security teams know if malware detection is actually working?
A: Look for behaviour-focused outcomes, not just alert volume.
Practitioner guidance
- Map AI-assisted delivery paths Identify where documents, chat messages, meetings, and summaries can trigger downstream execution or user trust decisions.
- Baseline normal cross-application behavior Build behavioral baselines across users, vendors, and applications so that unusual sequences stand out even when payloads change shape.
- Harden third-party cloud trust Review which external apps and integrations are implicitly trusted by employees and whether those trust paths are monitored at the identity and workflow level.
Bottom line: AI-assisted ransomware is reducing the cost and skill required to launch extortion campaigns, which makes frequency and variation the main defensive challenge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:35 pm
AI-driven malware is collapsing the economics of routine extortion. The important change is not just that ransomware is faster. It is that generative AI has reduced the cost, skill, and iteration barriers that used to constrain scale, which means defenders should expect more campaigns from less capable operators. For the field, this shifts the centre of gravity from expert malware craftsmanship to repeatable, industrialised abuse.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: Should organisations prioritise user trust controls or malware scanning first?
A: They should prioritise both, but user trust controls often need to move earlier when attacks travel through collaboration platforms and summarisation tools. If content can be activated by a normal workflow, malware scanning alone will not stop the initial execution path.
👉 Read our full editorial: AI-driven malware is accelerating ransomware and extortion campaigns