Hackers Used AI in 84% of Ransomware Attacks, Semperis Report Reveals

AI in Ransomware Becomes the New Normal

Cybercriminals exploited artificial intelligence in ransomware attacks experienced by 84% of surveyed victims, according to Semperis' 2026 Ransomware Risk Report released Wednesday1

1

. The cybersecurity report, conducted by cyber resilience company Semperis and research consultant Censuswide, surveyed 1,200 IT and security professionals across nine countries and eight industry sectors3

3

. The findings reveal how AI's role in modern cyber threats has fundamentally altered the ransomware landscape, making attacks faster, more sophisticated, and disturbingly autonomous.

Chris Inglis, former U.S. National Cyber Director and Semperis strategic advisor, warned that AI represents a turning point in cybercriminal capabilities. "AI is increasing not only the speed, scope, and scale of cyberattacks, but also their sophistication," Inglis stated3

3

. He emphasized that many AI-based attacks go unrecognized because they appear too slick and sophisticated to be attributed to automated systems.

Hackers Used AI in Ransomware Attacks to Exploit Victims' Own Systems

Perhaps most alarming is that 44% of surveyed victims experienced attacks where cybercriminals weaponized their own AI agents and systems against them1

1

. This represents a dangerous evolution where organizations' defensive technologies become weapons in attackers' hands. AI linked to ransomware attacks enables criminals to quickly identify weaknesses, tailor social engineering schemes to specific employees, automate intrusions, and readjust tactics as defenders respond2

2

.

Tomer Bar, Semperis's associate vice president of security research, noted that AI weaponized in ransomware schemes allows developers to produce more sophisticated malicious code while reducing development time. "We're starting to see more attacks with more rapid development, and attribution of these attacks will be more difficult for law enforcement," Bar explained2

2

. The technology also eliminates mistakes in attack encryption algorithms because attackers can test their code with large language models.

Autonomous Ransomware Attacks Are Already Here

Inglis revealed that autonomous ransomware attacks are no longer theoretical—they're already happening. "I think we're already seeing autonomous attacks. Autonomous ransomware attacks are included in the mix," he told CBS News2

2

. He described how individuals lacking technical expertise can now instruct AI systems to write code, penetrate networks, and hold data hostage without understanding how digital infrastructure operates. "We have democratized AI to the point where even low level models can allow that to happen," Inglis noted2

2

.

This democratization compounds the threat by expanding the pool of potential attackers while enabling experienced cybercriminals to operate more efficiently at greater scale. The technology lowers technical barriers that previously demanded specialized training and resources, fundamentally changing who can launch sophisticated attacks.

Physical and Psychological Threats Escalate Beyond Digital Boundaries

The Semperis report uncovered a disturbing trend: 40% of ransomware attacks involved psychological or physical threats against staff, and in 53% of these cases, hackers followed through on their threats1

1

. About 25% of victims sought psychological and medical treatment, while 24% of victims or their families hired personal security1

1

.

The human toll extends further: 23% of targeted companies reported employees and family members were doxxing victims, while another 23% experienced swatting incidents3

3

. These psychological threats drove 14% of organizations to report that sustained intimidation forced employees or family members to relocate homes, switch jobs, or move to different office locations1

1

.

"Holding you at physical risk is the latest phenomenon because we've covered most of the other risks," Inglis explained1

1

. He added that attackers have one goal: extract payment by making resistance more costly than compliance.

Identity Systems Remain Prime Targets Despite Known Vulnerabilities

The report found that 87% of ransomware attacks targeted identity systems such as Active Directory, Entra ID, and Okta, yet only half of companies maintain dedicated identity backup systems1

1

. This gap represents a critical vulnerability that attackers consistently exploit to gain network access and control.

Among surveyed victims, 69% experienced multiple successful attacks within the previous year, with 59% paying ransom at least once2

2

. More concerning, 31% of victims made multiple ransom payments to attackers1

1

, suggesting that paying once doesn't guarantee safety from repeat targeting.

AI Tools for Defense Show Mixed Results

While attackers leverage AI aggressively, defensive applications show uneven effectiveness. About 49% of surveyed victims used AI tools for defense to detect and counter attacks, but 23% reported their defensive AI tools failed to stop the malware3

3

. This suggests that while AI offers defensive potential, implementation and effectiveness remain inconsistent across organizations.

Mickey Bresman, Semperis CEO, emphasized the evolving nature of the threat: "The bad guys are always evolving their tactics." He noted that attackers initially focused on data encryption, then added data theft and exposure threats, and continue seeking new leverage points to extract payment1

1

. As AI capabilities advance, organizations face an adversary that adapts faster than traditional security measures can counter, making proactive cyber resilience essential rather than optional.