80% of ransomware attacks use AI, MIT study finds

A study of 2,800 ransomware incidents by researchers at MIT Sloan and Safe Security found that 80 percent of attacks now incorporate artificial intelligence, and experts warn the share is likely to rise further in 2025 as AI tools become more accessible to cybercriminals. The shift is reshaping common attack methods, accelerating intrusions and forcing organizations to rethink long-standing detection-first security models, researchers and industry officials said.

AI is being deployed across multiple phases of ransomware campaigns, according to the study and subsequent industry analyses. Attackers use AI to automate creation of harder-to-detect malware, craft highly personalized phishing messages, produce deepfaked audio or video to conduct social-engineering calls, and leverage large language models to assist with password cracking, CAPTCHA bypass and automated code generation. Those capabilities let attackers operate at speeds and at scales that human teams struggle to match.

"The attacker only needs one point of entry, while the defender must secure all points," Michael Siegel, principal research scientist at CAMS, said, describing an asymmetric challenge that is worsened by...