Loading story…
Ransomware operators are increasingly using large language models (LLMs) to accelerate established stages of the ransomware lifecycle—reconnaissance, phishing, data triage, and negotiation—rather than creating fundamentally new “AI ransomware.” Reporting citing SentinelOne Labs describes crews using LLMs to rapidly generate fluent, localized phishing lures and ransom communications, summarize and classify stolen documents to identify high-value leverage, and obtain step-by-step guidance for standing up infrastructure (e.g., basic loaders and C2 components). A notable enabler is the use of locally hosted/self-managed models (e.g., via Ollama) to reduce reliance on provider guardrails and increase operational flexibility, contributing to higher attack tempo, broader multilingual reach, and lower barriers to entry for less-skilled affiliates.
Extortion tactics are also evolving beyond encryption and data theft to include pressure based on regulatory and compliance exposure, with gangs threatening to report or highlight victims’ potential violations to increase coercion and urgency. This approach aligns with a broader trend of ransomware ecosystems fragmenting into many smaller crews and copycats while sharing tooling and playbooks across crimeware markets, increasing the volume of opportunistic campaigns and the likelihood that victims face both operational disruption and amplified legal/reputational risk during negotiations.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
A CSO Online news analysis reported that ransomware gangs were pressuring victims by citing potential compliance and regulatory violations as part of extortion efforts. This reflects an evolution in ransomware leverage tactics beyond simple encryption and data theft.
Analysis published in mid-January 2026 described threat actors moving toward local or self-hosted models such as Ollama to avoid provider guardrails, and breaking malicious development into benign-looking prompt fragments that are later combined offline. The same reporting pointed to early proof-of-concept tools like PromptLock and MalTerminal as signs of possible future runtime payload generation or adaptation.
SentinelOne Labs observed that ransomware and broader crimeware actors were using large language models to increase the speed, volume, and multilingual reach of phishing, ransom-note creation, data triage, and infrastructure setup. The reporting also noted a fragmented ransomware ecosystem with many smaller crews and copycats, and blurred lines between criminal and state-linked activity.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026
Recent research and industry analysis highlight the growing influence of large language models (LLMs) in both cyber defense and cybercrime. A study from the University of Bari demonstrated that LLM-generated phishing awareness training can measurably improve users' ability to detect phishing emails, with participants showing increased recall, precision, and overall detection skill after receiving AI-tailored lessons. The research found that even simple prompting methods, which personalize training based on user profiles, were as effective as more elaborate approaches, suggesting that LLMs can efficiently enhance phishing resilience through adaptive, scalable training content. Meanwhile, security researchers have observed that LLMs are accelerating the operational tempo of ransomware groups rather than fundamentally changing their tactics. LLMs are enabling lower-skilled threat actors to develop functional tools and infrastructure more easily, contributing to a proliferation of smaller, agile ransomware crews. These models also facilitate faster reconnaissance, phishing, and negotiation processes, and their multilingual capabilities expand the reach of cybercriminals. While LLMs have not introduced revolutionary new attack techniques, defenders should anticipate continued incremental efficiency gains among adversaries leveraging AI-driven tools.
Jun 29, 2026
Ransomware operators have expanded **double-extortion** tactics by targeting people around a victim organization, including senior executives, employees, customers, and business partners, to force ransom payments. Reporting tied the approach primarily to the **Clop** ecosystem, with similar behavior also attributed to **REvil** affiliates. Attackers were described as prioritizing executive mailboxes and workstations to find sensitive files, litigation records, and internal discussions that could be used to embarrass leadership or strengthen negotiations. The pressure campaign also extended beyond the company itself, with gangs emailing victims’ customers and associates to amplify reputational and legal risk. One cited case involved **RaceTrac Petroleum**, where data stolen via exploitation of a zero-day in **Accellion File Transfer Appliance** services used by a third party included some customer contact details, though the company said its corporate network and payment systems were not affected. Similar outreach was reportedly used against people linked to the **University of California**, underscoring how ransomware groups increasingly use public exposure and direct contact with stakeholders as leverage even when stolen data may later be leaked regardless of payment.
Aug 15, 2026