The Ransomware Playbook Has Been Rewritten: How AI Is Automating the Attack Chain#

Abstract#

Between 2024 and 2026, artificial intelligence transformed ransomware from a skilled-labor-intensive crime into an automated industrial operation. Threat actors now leverage large language models for reconnaissance and target profiling, generative AI for flawless spear-phishing and deepfake-enabled business email compromise, AI-orchestrated lateral movement that compresses breakout times to a median of 29 minutes, and emerging Ransomware-as-a-Service platforms that advertise AI-powered negotiation as a core product feature. The attack chain that once required weeks and an experienced operator can now be executed — from initial access to extortion demand — in under an hour by a low-skill affiliate equipped with the right tools. This article walks through each stage of the rewritten kill chain from the attacker’s perspective, then examines what has materially changed about the defender’s risk posture and which controls matter most for small and midsize businesses in this environment.

Keywords: ransomware, AI-augmented attack chain, LLM, spear phishing, deepfake BEC, BYOVD, EDR evasion, lateral movement, agentic AI, SMB cybersecurity, extortion-as-a-service

🎯 Executive Summary#

The Thesis#

The ransomware threat is no longer primarily a malware problem. It is an automation problem.

AI has systematically removed human expertise as the bottleneck at every stage of the attack chain. In August 2025, Anthropic disrupted a cybercriminal using Claude Code to conduct data theft and extortion against at least 17 organizations — demanding ransoms exceeding $500,000 with no encryption, no binary payload, and no human operator touching most of the operation.¹ One month later, a Chinese state-sponsored group designated GTG-1002 used Claude Code agents to carry out 80–90% of a cyber espionage campaign against approximately 30 targets autonomously.² In December 2024, a ransomware group called FunkSec posted 85 victims in a single month — outpacing every established operator — using AI to generate malware code that its inexperienced operators almost certainly could not have written themselves.³

These are not isolated incidents. IBM’s 2026 X-Force Threat Intelligence Index identified 109 distinct active extortion groups in 2025, up from 73 in 2024 — a 49% year-over-year increase driven directly by AI collapsing the skill barrier to entry.⁴ CrowdStrike’s 2026 Global Threat Report found that AI-enabled adversaries increased their activity by 89%, while the average eCrime breakout time — initial access to lateral movement — fell to 29 minutes.⁵

Three Implications for SMBs#

1. The perimeter no longer buys time. At 29-minute median breakout, the “detect and respond” model requires near-real-time alerting at the initial access phase — not after lateral movement.
2. Malware detection is necessary but insufficient. 82% of 2025 attack detections were malware-free — valid credentials, living-off-the-land binaries, and kernel-level driver abuse.⁵ A stack optimized for binary detection has large structural blind spots.
3. SMBs are the primary target class. Two-thirds of ransomware attacks target organizations with fewer than 500 employees.⁶ The mean recovery cost is $1.53 million.⁷ For most SMBs, a single incident is an existential financial event.

🕰️ Part I — The Old Playbook#

Understanding what changed requires knowing what was. Between roughly 2019 and 2022, a ransomware attack followed a recognizable pattern: a threat actor (or RaaS affiliate) purchased access from an initial-access broker, ran manual reconnaissance against the target, launched a phishing campaign from a handful of reused templates, waited days or weeks for a victim to click, then slowly traversed the network — manually escalating privileges, identifying domain controllers, and staging data — before finally deploying the encryptor. Median dwell time across this era exceeded seventy days. Breakout time from initial access to lateral movement was measured in hours.

That model was already industrializing by 2022 through the Ransomware-as-a-Service ecosystem, which commoditized execution and lowered the skill floor. What AI has done is collapse the floor entirely — while simultaneously accelerating every phase of the chain. SentinelOne Labs characterized the shift precisely: LLMs are not launching ransomware, they are optimizing it — acting as an operational accelerator at each stage rather than a wholesale replacement of human attackers.⁸

⚡ Part II — The New Playbook: Six Stages Rewritten#

Stage 1: Recon & Target Selection — The AI OSINT Engine#

Reconnaissance has historically been the most time-intensive phase of a ransomware operation. An attacker needed to manually correlate LinkedIn profiles, scrape job postings for technology stack disclosures, cross-reference data-breach dumps, and identify exposed services — work that could take days per target.

AI has turned this into a commodity pipeline.

Modern threat actors use LLM-assisted OSINT frameworks that ingest publicly available data — LinkedIn, job boards, corporate press releases, GitHub commits, DNS records, certificate transparency logs — and generate structured target profiles automatically: which subsidiaries share VPN infrastructure, which employees hold Active Directory admin privileges by job title, which vendors have supply-chain access to the network, and what software versions are running on exposed services.

The IBM 2026 X-Force Threat Intelligence Index observed a 44% increase in attacks beginning with exploitation of public-facing applications, a trend directly linked to AI-enabled vulnerability discovery tools that continuously scan for newly exposed services and match them against known CVE databases within hours of disclosure.⁴ Where it previously took attackers an average of 4.76 days to weaponize a newly published vulnerability, that window has collapsed to 24–48 hours.⁹

The 2023 Cl0p/MOVEit campaign — where automated exploitation of a zero-day vulnerability swept approximately 2,500 exposed servers in days — was an early illustration of what mass automated scanning achieves at scale.¹⁰ In 2025–2026, the same pattern has been supercharged with AI: GTIG documented the PROMPTFLUX dropper using LLMs to generate novel VBScript obfuscation in real time, and threat actors now routinely use AI-assisted tools to continuously scan the internet for newly exposed services and match them against CVE databases within hours of disclosure.¹⁰

Equally important: AI models don’t just scan. They prioritize. Victim profiling tools assess revenue (via public filings or LinkedIn employee counts), insurance coverage (inferred from job postings for insurance and risk roles), cyber maturity (from the absence of certain vendor relationships), and sector (healthcare and manufacturing pay faster and more). The result is a tiered target list, automatically ranked by expected payout probability.

Stage 2: Initial Access — Lures That Beat Humans#

Initial access has always been the ransomware chain’s most human-dependent link — and the one AI has most visibly transformed.

LLM-Generated Spear Phishing

The era of grammar-mangled phishing emails is over. Large language models produce grammatically flawless, contextually personalized lures in any language without discernible tells. An LLM fed a target’s LinkedIn profile, recent company press releases, and publicly available email threads can generate a spear-phishing email indistinguishable from internal communications — referencing real projects, real colleagues, real formatting conventions.

CrowdStrike’s 2026 Global Threat Report found that 87% of security professionals believe AI makes phishing lures meaningfully more convincing.⁵ That perception reflects operational reality: click rates on AI-generated spear phish are materially higher than template campaigns because they clear the cognitive hurdle that trained employees have been taught to identify.

Deepfake BEC and Vishing

Business email compromise has entered a new era with the convergence of voice cloning and video synthesis. Security researchers and fraud investigators have documented that modern AI tools can produce a usable voice clone from as little as 3–5 seconds of source audio, with accuracy sufficient to deceive listeners in real-time calls — material readily available from earnings calls, conference recordings, or LinkedIn videos.¹¹

In February 2024, a finance employee at the global engineering firm Arup was tricked into wiring $25 million to fraudster-controlled accounts after a multi-person video call featuring deepfake likenesses of the company’s CFO and other senior executives. No email thread. No document to inspect. Just a video call that looked and sounded exactly like his colleagues.¹¹

That incident is no longer an outlier. FBI data shows BEC attacks generated $2.77 billion in losses across 21,442 incidents in 2024.⁶ Russian-speaking ransomware operators BlackBasta and Cactus have specifically combined vishing campaigns with phishing to accelerate privilege escalation — calling employees posing as IT support while a phishing site collects credentials simultaneously.¹²

Automated Vulnerability Exploitation

Compromised VPN credentials account for 48% of ransomware initial access as of Q3 2025, up from 38% in Q2, according to Beazley Security’s quarterly incident response data.¹³ AI-assisted credential-stuffing tools continuously test breach dump credentials against enterprise VPN portals, MFA bypass techniques, and exposed admin interfaces — operating at a scale and persistence no human team can match. Google’s Threat Intelligence Group (GTIG) observed experimental dropper malware tracked as PROMPTFLUX in June 2025, using LLMs to dynamically generate VBScript obfuscation on demand — a concrete example of AI generating evasion logic in real time.¹⁰

Stage 3: Persistence & Privilege Escalation — Invisible in Plain Sight#

Once inside, the modern threat actor’s primary objective is to disappear. The old approach — drop a remote access trojan, establish a C2 beacon — is increasingly counterproductive against behavior-based endpoint detection. AI has helped attackers solve this problem through two converging techniques.

Living Off the Land (LOLBin) Orchestration

LOLBin attacks abuse legitimate Windows and system administration tools — PowerShell, WMI, certutil, mshta, PsExec — to execute malicious operations without introducing foreign binaries. The challenge for attackers has historically been knowing which tools to chain together in a specific environment to achieve a specific objective while avoiding specific detection signatures.

AI resolves this. CrowdStrike tracks the eCrime group PUNK SPIDER using AI-generated scripts to select and chain LOLBin techniques dynamically based on what’s available in the target environment — and to erase forensic evidence after each step.⁵ The result is lateral movement that reads as normal system administration traffic until it’s too late.

CrowdStrike’s 2026 Global Threat Report quantified the outcome: 82% of all 2025 detections were malware-free — attackers using valid credentials, trusted identity flows, and approved SaaS integrations instead of traditional malware payloads.⁵

BYOVD: Killing the Guardrails

Bring Your Own Vulnerable Driver (BYOVD) attacks load a legitimately signed but vulnerable kernel driver onto the target system. Because the driver carries a valid Microsoft signature, Windows permits it to execute at kernel level. The attacker then exploits the driver vulnerability to terminate EDR processes, unregister kernel callbacks, and disable security controls entirely — effectively blinding the defender before proceeding.

BYOVD adoption has become standard in sophisticated ransomware operations. A single campaign targeting the TrueSight driver deployed over 2,500 distinct driver variants to evade signature-based detection between mid-2024 and early 2025.⁵ In February 2026, the Reynolds ransomware strain embedded a vulnerable driver directly within the ransomware payload itself, eliminating a separate EDR-killing deployment step and compressing the defender’s detection window.¹⁴

Qilin and Warlock ransomware operations have deployed BYOVD techniques capable of silencing more than 300 EDR drivers from nearly every major security vendor — via a malicious DLL (“msimg32.dll”) that terminates EDR kernel callbacks on load.¹⁴ EDR bypass tools are now commoditized on underground forums at $300–$10,000, accessible to affiliates with no kernel-level expertise of their own.¹⁴

Russia-nexus FANCY BEAR has gone further, deploying LAMEHUG — LLM-enabled malware that automates reconnaissance and document collection post-compromise, reducing the need for any manual operator interaction after the initial foothold.⁵

⚠️ Defender note: Standard EDR is insufficient against BYOVD attacks that kill the EDR process itself before any alert is generated. Kernel-level tamper protection and monitoring against Microsoft’s Vulnerable Driver Blocklist are required, not optional.

Stage 4: Lateral Movement — The 29-Minute Breakout#

The CrowdStrike 2026 Global Threat Report contains a number that reframes every conversation about detection and response: the average eCrime breakout time — the interval between initial access and lateral movement to additional systems — is now 29 minutes. The fastest observed breakout in 2025 occurred in 27 seconds.⁵

Mandiant’s M-Trends 2026 report adds precision: the median initial-access-to-handoff interval — the time between a threat cluster gaining access and transferring control to a secondary operator for follow-on activity — has fallen to 22 seconds, down from over eight hours in 2022, reflecting increasing automation and division of labor across the criminal ecosystem.¹⁵

These numbers matter because most enterprise detection and response workflows — even mature ones — assume a detection-to-containment cycle measured in minutes to hours. At 29-minute median breakout, that window has effectively closed.

The mechanism is automated network enumeration: AI tools rapidly map Active Directory structures, identify privileged service accounts, locate domain controllers, and determine the fastest path to domain admin — then execute that path using credential material harvested during initial access (typically via infostealer malware or LSASS dumps). IBM X-Force noted that infostealer malware exposed over 300,000 enterprise AI chatbot credentials in 2025 alone, many of which contained embedded SSO tokens providing direct network access.⁴

Lateral movement speeds dropped 29% in 2025 to an average of 34 minutes, with the time to first Active Directory attack averaging approximately 11 hours after initial access in less-aggressive operations.⁵

Stage 5: Data Exfiltration — Smarter Staging, Faster Exit#

Data exfiltration has traditionally been a high-signal phase: large volumes of unusual outbound traffic are exactly what network detection tools are built to flag. AI has made this phase quieter and faster simultaneously.

AI-assisted staging tools now analyze the accessible file system and prioritize what to exfiltrate based on value signals — financial records, intellectual property, HR data containing PII, legal documents referencing regulatory compliance or litigation, and anything with “insurance,” “contract,” or “executive” in the metadata. Low-value data (marketing assets, general documentation) is skipped entirely. High-value data is staged and exfiltrated first, ensuring that even a partial operation yields maximum extortion leverage.

Exfiltration times have collapsed accordingly. Data exfiltration now takes a median of 6 minutes — down from approximately 4 hours in 2024 — enabled by AI-orchestrated parallel upload streams that blend into normal cloud synchronization traffic.⁵

The August 2025 extortion campaign Anthropic disrupted is instructive here: the operator used no encryption at all. The attack was pure exfiltration followed by an extortion demand — targeting at least 17 organizations including hospitals, emergency services, and government agencies. No ransomware binary means no endpoint detonation signature, no shadow copy deletion, no detectable encryption I/O. The “ransomware” threat was entirely psychological: pay or the data is published.¹

This “encryption-free” model is becoming more common. It leaves fewer forensic artifacts, requires no decryption key management, and produces the same financial outcome while generating less defender telemetry.

Stage 6: Encryption, Extortion & Negotiation — The AI-Augmented Squeeze#

The final phase has been transformed less by technical automation and more by the professionalization of the extortion apparatus itself.

Negotiation as a Service

GLOBAL GROUP — a RaaS platform that emerged in June 2025 as a rebrand of the disrupted BlackLock operation — explicitly advertises an AI-powered negotiation system as a core platform feature.¹⁶ The system analyzes victim communications to calibrate pressure tactics, suggest optimal ransom anchor amounts, and identify which psychological levers (regulatory exposure, reputational damage, customer notification obligations) are most likely to accelerate payment.

Qilin has taken professionalization further still, employing dedicated legal advisory services that review stolen data, assess potential regulatory violations in the victim’s jurisdiction, and prepare documentation for submission to relevant authorities.¹⁴ The implicit threat: pay, or we file the regulatory complaint for you. The group also maintains an internal PR and media relations team dedicated to shaping public narratives and intensifying reputational pressure on non-paying victims.

Scale of the Extortion Economy

Ransomware groups posted 3,734 victims on public extortion sites in H1 2025 — a 67% jump compared to the same period in 2024, and a 20% increase over H2 2024.¹⁶ IBM X-Force identified 109 distinct extortion groups active in 2025, up from 73 in 2024, with active group count growing 49% year-over-year as AI lowered the barrier to standing up new operations.⁴

Mentions of malicious AI tools on dark web cybercrime forums surged 219% throughout 2024, according to threat intelligence firm KELA — with “dark AI” tools evolving into AI-as-a-Service subscription offerings that automate phishing content, deepfakes, and credential harvesting at scale.¹⁷

The lowering of the skill floor is the direct cause of ecosystem fragmentation. FunkSec — a group that emerged in late 2024 and posted 85 victims in December 2024 alone, outpacing every established operator — was operated by inexperienced actors who used AI-assisted malware development to build their toolkit.³ Check Point Research noted that FunkSec’s code contains extensive LLM-typical comments written in perfect English — markedly inconsistent with the group’s basic English in every other communication channel.³ The AI did the engineering. The humans did the targeting and the extortion calls.

This is the defining characteristic of the new ransomware economy: expertise is no longer the bottleneck.

🛡️ Part III — The Defender’s Response#

What Has Actually Changed About Your Risk Posture#

The threat landscape shift described above has three concrete implications for SMB security posture.

The perimeter no longer buys you time. If median breakout is 29 minutes and can be as fast as 27 seconds,⁵ the traditional “detect and respond” model — which assumes hours of attacker dwell time — is operationally broken against a prepared adversary. Detection must happen at the initial access phase, not after lateral movement has begun. Sophos’s 2025 Active Adversary Report puts median dwell time at 2 days across all cases, and 3–4 days in ransomware cases specifically — but those figures reflect cases where defenders caught attackers.¹⁸ Against an AI-assisted attacker operating on a 29-minute breakout timeline, the 2-day dwell window may never open.

Malware detection is necessary but no longer sufficient. When 82% of techniques are malware-free — valid credentials, LOLBins, BYOVD-killed EDRs — a security stack optimized for binary-based detection has large structural blind spots.⁵ Behavioral analytics and identity-centric detection are not optional additions; they are the primary detection surface.

SMBs are the preferred target, not an afterthought. Two-thirds of ransomware attacks target organizations with fewer than 500 employees.¹⁹ 88% of SMB breaches include a ransomware component, compared to 39% at large enterprises.¹⁹ The FBI’s 2024 IC3 Report recorded 3,156 ransomware complaints with $12.4 million in adjusted losses — a figure widely acknowledged to undercount actual incidents significantly.⁶ The mean recovery cost from a ransomware attack is $1.53 million (Sophos State of Ransomware 2025), with a median ransom demand of $1.32 million.⁷ For most SMBs, a single incident is an existential financial event.

Detection Signals Per Stage#

The attack chain above generates behavioral signals at each phase. The challenge is detection speed and fidelity — particularly now that the window between signal and impact has compressed to minutes.

Controls That Actually Matter Now#

The following six controls address the highest-leverage attack vectors in the AI-augmented kill chain, listed in priority order for organizations with constrained security budgets.

1. Phishing-resistant MFA (FIDO2 / hardware tokens) Compromised VPN credentials were the initial access vector in 48% of ransomware attacks in Q3 2025.²⁰ SMS and authenticator-app MFA are increasingly bypassed through real-time adversary-in-the-middle phishing proxies. FIDO2 hardware tokens or device-bound passkeys are the only MFA methods currently resistant to real-time credential interception. This is the single highest-leverage control available to SMBs today.

2. Network segmentation and least-privilege access AI-assisted lateral movement exploits flat architectures where any compromised endpoint can reach domain controllers and file servers in seconds. Micro-segmentation — even partial, between IT and operational systems, or between workstations and servers — dramatically increases the cost of lateral movement and creates detection chokepoints.

3. EDR with kernel-level tamper protection and BYOVD detection Standard EDR is insufficient against BYOVD attacks that terminate the EDR process before any alert is generated. Select vendors that include kernel-level tamper protection and actively monitor for driver loads against Microsoft’s Vulnerable Driver Blocklist. The absence of this capability is a meaningful gap in 2026.

4. Identity hygiene: privileged account audit and credential exposure monitoring 82% of attacks are malware-free — your attacker is logging in, not breaking in.⁵ Regular privileged account audits, service account password rotation, and continuous monitoring of credential exposure (breach dump correlation, infostealer market monitoring) address the primary entry point.

5. Immutable, tested, offsite backups Immutable backups stored offline or in a non-domain-joined environment remain the most reliable recovery path when encryption has already occurred. The critical qualifier is tested: an untested backup is not a reliable control. Establish a documented, practiced recovery runbook.

6. Out-of-band verification protocols for high-risk requests The Arup incident established that sophisticated employees can be deceived by high-quality deepfake video calls.¹¹ Implementing mandatory out-of-band verification for any wire transfer, credential change, or unusual access request — regardless of how convincing the requestor appears — is the highest-leverage control against AI-generated social engineering and voice-clone vishing.

🔮 Closing: The Next Eighteen Months#

The trajectory of AI-assisted ransomware points toward one destination: the fully autonomous attack chain. Agentic AI systems — AI models that plan, act, and iterate without human intervention — are already demonstrating the capability to complete the full ransomware lifecycle in approximately 25 minutes. Palo Alto Networks’ Unit 42 simulated this in a controlled environment: from initial compromise to full data exfiltration, with the agent autonomously switching exfiltration channels mid-transfer without triggering a single alert.²¹ The emerging Model Context Protocol (MCP), which allows AI agents to connect to external tools, databases, and services, is creating a new and largely unexamined attack surface: a misconfigured or compromised MCP server becomes a universal pivot point that exposes every AI agent connected to it.²²

IBM X-Force projects that as multimodal AI models mature, adversaries will automate the entire chain — reconnaissance, exploitation, lateral movement, exfiltration, and negotiation — without any human hand on the operation between deployment and payout.⁴ Barracuda Networks identifies agentic AI as the defining threat multiplier of 2026, noting that tasks previously requiring an experienced operator to plan and execute over days can now be delegated to an agent that runs continuously until it achieves its objective or is shut down.²³

The ransomware threat is no longer primarily a malware problem. It is an automation problem. The organizations that survive the next wave will be the ones that close the identity gaps, compress their detection windows, and accept that the human attackers who used to be the bottleneck are no longer in the loop.

🔗 References#

All sources cited in this report: