Ransomware's New Era: Moving at AI Speed

This report outlines 2025–2026 ransomware trends: attackers are accelerating attacks by using valid credentials, offensive security tooling, automation and AI to bypass EDR, steal and extort data (double/triple extortion), and scale social-engineering (including deepfake vishing). It highlights increased incident frequency (ransomware comprised 44% of IR cases for one provider), the rise of infostealers and credential-based intrusions, the emergence of new dominant groups (Qilin) and impersonation activity, and defensive gaps in access management and legacy devices.