From Cameo To Lead Role: AI Takes Over Ransomware

Etay Maor is Vice President of Threat Intelligence for Cato Networks, a converged network and security cloud for the AI era.

​As much as 48% of breaches involve ransomware, and AI is making it more effective. While AI has certainly made malware smarter, it has also enabled unskilled actors to run attacks that were once the domain of highly trained threat actors.

AI has essentially democratized the ransomware attack vector.

Why Ransomware Needs Skills

Most ransomware today is available as ransomware-as-a-service (RaaS) kits. There is a core group that builds the malware and manages the leak site that publishes stolen data. Affiliates carry out the attack and pay the core group a share of the ransom they collect.

From the perspective of the affiliate, getting into the network is the first step, but the real work comes afterward. It involves figuring out the network structure, identifying the systems that are attack-worthy and ensuring they stay hidden long enough to deploy the encryptor that locks the victim’s files. This process takes days or even weeks of hands-on work. Ransomware negotiation is also a manual effort, typically involving an individual who might or might not have a real sense of what the data is actually worth.

Not every affiliate is a master at launching a successful ransomware attack. They work on a limited number of victims at a time. While defenders can pat themselves on the back for deflecting an attempted attack, many times, their defenses appear better than they actually were because the attack was conducted by amateurs.

Three Areas Where AI Shows Up

Last year, the number of active ransomware groups rose 49%, according to IBM. Part of the reason is AI, which lets attackers automate processes that used to take skill and time. Affiliates see AI as a great leveler to fill in the missing know-how that can help accelerate attacks at scale.

This has led to AI showing up in ransomware in three distinct ways: