Loading story…
MIT Sloan and Safe Security withdrew a working paper that claimed over 80% of ransomware attacks in 2024 involved artificial intelligence, following widespread criticism from cybersecurity experts. The paper, which was cited in an MIT Sloan blog post and echoed in other media, asserted that AI played a significant role in the majority of recent ransomware incidents. However, security researchers, including Kevin Beaumont and Marcus Hutchins, publicly challenged the study's methodology and findings, highlighting a lack of evidence and inaccuracies such as referencing defunct malware like Emotet as AI-driven.
After the criticism gained traction online, MIT removed the study and updated related blog content to reflect a more cautious stance on AI in cyberattacks. The incident has sparked broader discussion about the responsibility of academic and security organizations to ensure accuracy in research, especially regarding emerging technologies like generative AI. The episode also raised concerns about the influence of marketing and vendor interests in shaping cybersecurity narratives without sufficient empirical support.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
After public criticism, the MIT webpage and paper were reportedly removed, shelved, or rewritten without clear change notes, while archived copies remained available. The change was described as a quiet update following scrutiny of the study's claims and disclosures.
Security researcher Kevin Beaumont publicly criticized the paper as methodologically unsound and said it contained incorrect or unsupported claims about ransomware groups and malware. He also highlighted an alleged undisclosed relationship involving the lead author, Safe Security, and MIT Sloan funding.
MIT Sloan and Safe Security released a working paper and associated MIT webpage claiming that roughly 80% of ransomware attacks use generative AI. The paper was then circulated and cited as research on AI-enabled ransomware trends.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A demonstration of an academic AI-powered ransomware prototype caused significant alarm, highlighting the growing risk that experimental AI malware could inadvertently spark real-world crises. The incident underscored how the boundary between controlled lab environments and live cyber threats is increasingly blurred, raising concerns among security professionals about the potential for accidental or intentional misuse of AI-driven attack tools. Simultaneously, security experts have warned that attackers are leveraging AI to automate ransomware campaigns, craft sophisticated phishing attacks, and deploy deepfake technologies for espionage, such as infiltrating job interviews. These developments illustrate the expanding threat landscape posed by generative AI, emphasizing the urgent need for robust risk management and security controls to address both experimental and operational AI-enabled cyber threats.
Jun 29, 2026
Ransomware attacks are becoming increasingly sophisticated and rapid, largely due to the integration of artificial intelligence (AI) by threat actors. Security leaders are expressing heightened concern over AI-enabled ransomware, with 38% of CISOs ranking it as their top security issue according to recent industry surveys. The 2025 State of Ransomware Survey by CrowdStrike highlights that 76% of organizations struggle to keep pace with the speed of AI-powered attacks, revealing a significant gap between perceived and actual preparedness. Despite high confidence levels, 78% of surveyed organizations have experienced a ransomware attack in the past year, underscoring the urgent need for improved defenses. Adversaries are leveraging AI to accelerate every stage of the attack chain, from malware development to social engineering, drastically reducing defenders' response windows. In response, cybersecurity professionals are exploring innovative defensive measures, such as malware vaccines, which were a focal point at the recent ONE Conference in The Hague. These vaccines work by making cosmetic changes to Windows systems, such as creating decoy files, editing registry keys, or simulating infection markers, to trick ransomware into aborting its attack. Techniques include placing fake mutex objects or running processes that signal to malware that the system is already compromised or is a virtual machine, thereby deterring infection. Some methods, like the EmoCrash kill switch developed by Binary Defense, have successfully disabled specific malware strains by manipulating registry entries. However, while these proactive measures show promise, they also carry risks, particularly when altering system registries. The rapid evolution of AI-driven ransomware is outpacing traditional security tools, prompting calls for more intelligent, adaptive defenses. Security teams are urged to reassess their readiness, invest in advanced endpoint protection, and consider novel approaches like malware vaccines as part of a layered defense strategy. The convergence of AI in both offensive and defensive cyber operations marks a pivotal shift in the threat landscape, demanding continuous innovation and vigilance from defenders. As ransomware continues to rampage across industries, the balance between prevention and cure is being redefined by the capabilities of AI on both sides. Organizations must recognize that legacy defenses are insufficient against the speed and sophistication of modern ransomware. The cybersecurity community is actively researching and sharing new techniques to stay ahead of attackers, but the challenge remains formidable. Ultimately, the fight against AI-enabled ransomware will require a combination of technological innovation, strategic investment, and ongoing education for security professionals.
Jul 12, 2026
Threat researchers and industry reports say cybercriminals are increasingly using **AI-powered tooling** to improve phishing, social engineering, credential theft, malware development, and activity inside compromised networks. Sophos found growing discussion across underground forums and marketplaces about large language models being used for multilingual lures, deepfake-enabled fraud, and other attack workflows, while ReliaQuest reported that AI has made attacks cheaper, faster to scale, easier to customize, and harder to detect without fundamentally changing core intrusion tradecraft. Proofpoint’s 2026 ransomware survey found **65%** of victim organizations believed AI increased attack effectiveness, with human interaction frequently enabling initial access through malicious links, attachments, and credential harvesting. Researchers said AI is now being applied to industrial-scale phishing, identity fabrication, phishing pages, web shells, credential harvesters, code padding to evade static analysis, and fake AI-branded downloads, while some criminals also worry automation could displace manual operators or degrade criminal product quality. Defenders were urged to reinforce core controls including **MFA**, passkeys, patching, behavioral detection, environment visibility, and defense-in-depth as AI-assisted attacks become more convincing and covert.
Aug 11, 2026