AI-Accelerated Ransomware: What Actually Changed, and What To Do About It
Japan declared its first cyberspace emergency on 9 October 2026, after a wave of ransomware and data breaches touching the personal data of more than 14 million people. Officials and local commentary attributed part of the surge to AI-accelerated attacks. Trackers of ransomware leak sites recorded a sharp week-over-week rise in published victims in early October, with the United States accounting for just under half.
"AI is making ransomware worse" is the easy conclusion, and it is partly right. It is also the kind of claim that gets written up without anyone saying which part of an attack actually changed. That distinction matters, because it determines which of your controls still work.
First, a caveat about the numbers
Ransomware statistics mostly come from leak-site counts — the victim names gangs publish to pressure payment. They are a useful proxy and a poor census.
They undercount organisations that pay quickly and never get listed. They overcount in the sense that groups post duplicates, re-post old victims, and occasionally invent entries. A week-over-week jump can reflect one group clearing a backlog rather than a change in attack volume.
So: the direction is real and corroborated across several trackers. The precise percentage is softer than it looks. We would not build a budget case on a single week's figure, and neither should anyone selling you one.
What AI genuinely changed
Three parts of the attack chain got materially cheaper. All three are at the beginning.
Language. This is the clearest effect, and Japan is the case study. Japanese has functioned as a partial barrier for years — phishing in awkward Japanese was easy to spot, which kept volume down relative to English-speaking markets. Machine translation good enough to produce fluent, register-appropriate business Japanese removes that barrier. The same applies to every market previously protected by a language attackers did not write well.
If your organisation operates in a language that has historically shielded it, expect that to stop being true.
Pretexting. Building a convincing approach used to require research time: who reports to whom, what a real invoice looks like, which supplier is mid- contract. Summarising a target's public footprint into a usable pretext is now quick and cheap. The effect is not better attacks at the top end — skilled operators were always good at this — but far more mid-quality attacks, which is what moves volume.
Triage after access. Once inside, working out which file shares matter, which data is regulated, and where the leverage is was slow manual work. That got faster, which compresses the window between intrusion and extortion.
What AI did not change
The way in. The initial access routes are the same ones: an exploited internet-facing appliance, stolen or sprayed credentials, a compromised supplier, a phished session token. October's incidents illustrate it — FortiMail, Ivanti and Cisco appliance flaws exploited before patches shipped; a cloud provider's compromise cascading to 495 customers; a year-old SharePoint chain still producing victims. None of those required AI.
The controls that stop it. MFA still defeats credential spraying. Patching the internet-facing appliance still closes that path. Segmentation still limits how far an intrusion travels. An offline, tested backup still determines whether you pay. Nothing on that list got weaker because the phishing email got better.
The economics of extortion. Encrypt, exfiltrate, threaten, negotiate. The mechanics are unchanged.
This matters because the practical implication of "AI made attacks better" is usually taken to be "we need an AI defence product". The more defensible reading is that the volume of competent attempts went up, so the controls you already knew you needed now get tested more often.
What to do about it
Nothing here is new, which is rather the point. Ordered by effect.
1. Phishing-resistant MFA where it matters. Not all MFA is equal. SMS and push-approval are defeated by proxy phishing kits that relay the session in real time, and better lures mean more people reach the kit. Passkeys or hardware keys for administrators, finance and anyone with access to payment systems. If that is too big a project, start with those three groups.
2. Verification steps that do not depend on spotting a fake. Awareness training is worth doing and it is not a control you can lean on when the lure is fluent and well-researched. What holds is process: a payment-detail change confirmed by callback to a number you already had, dual authorisation above a threshold, and no exceptions for urgency. Urgency is the tell, and it is also the pressure that breaks the process.
3. Shorten your exposure window on internet-facing systems. Volume means less time between a vendor advisory and someone trying it on you. An emergency patch path you can execute in hours is a genuine control. See patch management.
4. Backups that survive the attacker. Offline or immutable, separate credentials, and restore-tested. This single control is the difference between an expensive week and an existential event — and attackers now target backup infrastructure as standard, as the ransom claims in the Japanese incident illustrate.
5. Detection you can confirm is working. Faster triage after access means less dwell time to catch. Know that your EDR is deployed and reporting everywhere, that logs leave the box, and that someone is looking out of hours. That last part is why managed detection exists; our MDR/XDR practice covers it, and ransomware readiness controls that work covers the rest.
6. Rehearse the decision, not just the recovery. Who decides whether to pay, on what information, with which lawyer and which insurer on the call. Deciding that during the incident is how organisations end up paying for a decryptor they did not need.
On the defensive side of AI
Worth being even-handed: the same capabilities help defenders. Triage of alert queues, summarising an incident timeline, drafting detection logic, spotting anomalies in volumes of log data no human reads. We use it, carefully, and it measurably reduces time-to-triage.
It is not a control, though. It makes analysts faster, which matters when the volume of attempts rises — but a faster analyst is not a substitute for MFA, a patch, or a backup. Any vendor positioning AI as a replacement for those is selling the wrong thing, and the attacks in the news this month would all have been prevented or contained by unglamorous basics.
The summary
Attacks got cheaper to attempt and better written. They did not get harder to stop. The organisations having a bad October are, with few exceptions, the ones that were internet-facing and unpatched, relying on push-approval MFA, or holding their only backup in the platform that got encrypted.
Volume raises the frequency with which your controls are tested. It does not change which ones work.
