AI and Automation Accelerate Ransomware Operations and Intrusion Speed

Recent reporting and threat research indicate AI and automation are materially compressing attacker timelines, reducing defenders’ opportunity to detect and contain intrusions. A ReliaQuest analysis cited by SC Media found lateral movement can occur in as little as four minutes (with average lateral movement time dropping from 48 to 34 minutes), and data exfiltration in the fastest cases falling to six minutes (down from more than four hours previously). The same reporting notes 80% of ransomware groups are leveraging AI and/or automation for data theft, and highlights BoaLoader as an example of converged AI-assisted development, social engineering, and traditional cybercrime activity.

Separate ransomware telemetry from NCC Group shows overall publicly disclosed ransomware incidents dipped month-over-month in January but remained broadly consistent year-over-year (741 vs. 696), with North America accounting for 54% of activity and industrials the most targeted sector (32%). The report identified Qilin as the most active group (108 cases), followed by Akira and Sinobi, and warned that attacker tradecraft is expanding to new initial access paths, including messaging platforms (e.g., WhatsApp, Signal, Telegram) via device-linking scams and malicious QR codes. ASEC’s weekly “Ransom & Dark Web Issues” roundup provides additional context on ongoing ransomware and hacktivist activity (e.g., Morpheus targeting a South Korean plating company and Ailock republishing prior victims), but it is not clearly tied to the same specific datasets or findings on AI-driven acceleration described in the other reporting.