It's Monday morning. Right after you start work as usual, your machine slows to a crawl. File names change, and an unfamiliar message appears on the screen. This is hardly an unusual ransomware scenario, but recent cases have started to change in character.
The phishing that serves as the entry point no longer comes with awkward Japanese or sloppy wording. Emails and messages arrive that mimic internal phrasing, fit the context of each department, and are polished just enough that recipients do not hesitate. With generative AI absorbed into the attacker's toolkit, ransomware is shifting from "attacks sprayed carelessly by large crews" toward "attacks that even small teams can run with high precision."
What generative AI has changed is the "speed" before and after the intrusion
The arrival of generative AI does not mean ransomware now works on fundamentally different principles. What has changed is how quickly attacks get started and unfold. Work that used to take real effort, from drafting phishing messages and impersonating a target company to luring victims with internal information and mass-producing malware variants, can now be done in a short time. Zscaler ThreatLabz's 2025 phishing report likewise notes that while mass phishing is declining, the weight is shifting toward precise attacks narrowed to higher-value targets.
What is frightening on the ground is not so much that attack emails are better written, but that "each attacker's throughput goes up." Reconnaissance, message drafting, language tuning and automated replies that once had to be split among several people can now be handled by far fewer. Our impression is less that the base of attackers is widening and more that operations are being tuned for success rates.
What has stood out from 2024 into 2025
Public reports from the past year or so show ransomware still on the rise. Zscaler ThreatLabz's 2025 report states that over its analysis period of April 2024 to April 2025, blocked ransomware attacks rose 145.9% year over year, public extortion cases rose 70.1%, and the volume of stolen data rose 92.7%. Manufacturing, technology and healthcare were the most targeted sectors, with oil and gas and government also showing large increases.
What we especially do not want to overlook is that the center of gravity of attacks is no longer just "encrypt and disrupt." CISA's #StopRansomware Guide explicitly describes "double extortion," which combines encryption with data theft and threats of publication, and also notes cases in which no encryption occurs at all and the leak itself becomes the bargaining chip. These days it is hard to grasp the full extent of the damage unless you look not only at "whether the files can be restored" but also at "what will be done with the information that got out."
Spread through supply chains and MSPs also remains a serious issue. CISA warned early on that when an MSP is compromised, a single intrusion can reach multiple customers. Its 2025 advisories also cover cases in which downstream customers were affected via RMM, so this remains a very real risk. Hardening your own company alone is not enough; unless you also look at how you are connected to contractors and operational platforms, you will misjudge where the damage can come in.
Another clear trend is that credentials have become even more valuable. In the US Department of Justice's description of LockBit, affiliates not only broke into vulnerable systems but also bought stolen access credentials to use as footholds. Exploits are not obsolete, but there are certainly more situations in which seizing identities and sessions is the faster route.
Moreover, the targets are not limited to Windows. Akira initially focused on Windows, but a Linux version later appeared, and activity targeting VMware ESXi has been observed. For Play as well, CISA explicitly mentions an ESXi variant. Unless you protect servers, virtualization platforms, backups and cloud-side operations too, endpoint defense alone will not be enough.
The lineages that are hard to drop from the watch list
The original article named BlackCat / ALPHV, LockBit, Royal / BlackSuit, Play and Akira as the lineages to watch for 2025 to 2026. The list itself is not far off, but the real balance of power is quite fluid. Recent public reports also show a strong presence from RansomHub and Clop, so looking at a simple "fixed top five" makes it easy to miss what is actually happening.
- BlackCat / ALPHV
The US Department of Justice carried out a large-scale disruption in late 2023 and described it as a RaaS that had claimed more than 1,000 victims. It no longer exists in its heyday form, but its attack methods and operating model still influence today's lineages. - LockBit lineage
It was badly shaken by Operation Cronos in 2024, but the Department of Justice described pre-takedown LockBit as "one of the most active and destructive variants in the world," with more than 2,000 victims and more than $120 million in ransom payments received. Even if the brand has lost momentum, you need to watch where its methods and people end up. - Royal / BlackSuit
CISA explicitly identifies BlackSuit as an evolution of Royal. It is a lineage worth noting as an example of continuity in operators and TTPs despite a change of name. - Play
CISA updated its advisory on Play in June 2025, stating that it has affected businesses and critical infrastructure across a wide area of North America, South America and Europe. Including its moves against ESXi, it is a low-profile but persistently dangerous lineage. - Akira
It had a strong presence from 2024 into 2025 and is listed among the top groups in Zscaler's 2025 report. CISA's update also shows activity extending beyond Windows to Linux/ESXi.
What is likely to grow is quieter extortion
Looking ahead, what seems most likely to grow is "quieter attacks." The approach of skipping large-scale encryption, first exfiltrating data and then negotiating with threats of publication and fear of secondary damage has already moved into the real mainstream. Zscaler's 2025 report also states clearly that the emphasis is shifting from encryption to extortion.
In addition, attacks targeting identities and cloud misconfigurations should grow even stronger. CISA's Zero Trust Maturity Model is organized around five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Put the other way around, attackers will come to break those touchpoints one by one. The further cloud migration goes, the more the contest centers on identities, privileges, sessions and misconfigurations rather than perimeter defense.
Social engineering using voice and video is also becoming impossible to ignore. The NSA, FBI and CISA flagged text, voice and video impersonation using deepfakes as a concern early on, and in 2025 the FBI/IC3 also publicized a scheme that impersonated senior officials with AI-generated voice and text, steering targets to a different messaging platform to compromise their accounts. Rather than deepfakes being built directly into ransomware itself, it is more natural to see them entering as components that improve the precision of initial access and privilege takeover.
Attackers are not the only ones using AI
The original article touched on the role of ThreatLabz, but here the way of thinking matters more than any product name. If attackers are using AI to gain speed and precision, defenders also need to run threat intelligence, malware analysis, detection updates and forensics together, and much faster.
In practice, what pays off in ransomware response is tracking attack infrastructure, monitoring C2 and leak sites, comparing variant samples, rapidly applying IOCs, and supplying recovery material to affected organizations. Simply "investigating carefully" after the damage is done is too late; you need a design that picks up external signals in peacetime and stops the spread quickly after an intrusion. Regardless of whether AI is involved, this is where differences in defensive operations will most readily show from here on.
Zero trust is a design for keeping ransomware from "spreading"
Zero trust tends to be treated as a convenient buzzword, but in ransomware defense it is very practical. As CISA's model shows, its axes are divided into Identity, Devices, Networks, Applications and Workloads, and Data. These are exactly the angles from which to stop ransomware's lateral spread.
Specifically, the pillars are: not settling for MFA alone but also monitoring sessions; restricting privileges to make lateral movement harder; gaining visibility including internal traffic; not leaving externally exposed remote access unattended; maintaining good hygiene for cloud identities and IAM; and classifying important data so that exfiltration can be traced. CISA's #StopRansomware Guide, in its updated version, emphasizes cloud backups and zero trust, and also recommends adopting zero trust and least privilege to protect remote access.
When it comes to ransomware defense, attention tends to go to recovery and backups at the very end. Those certainly matter, but where the real difference in damage emerges is how far you can keep an intrusion from spreading. The value of zero trust is not in eliminating intrusions entirely, but in preventing the compromise of one device or one account from turning into the shutdown of the whole organization.
The final chapter is decided by design before the intrusion, not by panic after it
Ransomware is not going away. Even after major takedowns, lineages shift, names change, and they come back with different operating models. Indeed, the 2025 ThreatLabz report identified 34 new groups, and the balance of power is shifting considerably.
Still, there is no need to view it with pure pessimism. If attacks have become faster, defenders can sharpen their own entry points. Protect identities, stop lateral movement, don't miss data theft, and defend by "how things are connected," including contractors and the cloud. Organizations that can make this shift in thinking can substantially change the scale of the damage.
Generative AI is a convenient tool for attackers, but it does not decide the outcome on its own. In the end, the difference comes down to operations. If you are reviewing your company's ransomware defenses, before asking whether you have anti-malware products, it is worth taking stock once of how authentication, privileges, remote access, cloud configuration and data protection connect to one another.
