AI Is More Likely to Optimize Ransomware Than Make It Autonomous
Summary
The article argues AI is more likely to improve ransomware operations and stolen-data monetization than enable autonomous attacks, citing human-directed JADEPUFFER, BlackBasta’s routine AI use, FulcrumSec’s data analysis, and Leak Bazaar.
Key points
- The article argues ransomware innovation has largely been driven by profitable business models and organization, rather than new technical capabilities.
- It says AI use in ransomware remains incremental, with limited evidence of widespread adoption or end-to-end autonomous operations.
- BlackBasta’s leaked chats reportedly show discussion of using ChatGPT for phishing, debugging persistence tools, and checking stolen email addresses.
- JADEPUFFER was not fully autonomous: the article says a human directed target selection, infrastructure building, and oversight.
- A GuidePoint Security report described FulcrumSec using an LLM to analyze stolen data for leverage during victim negotiations.
- The article says Leak Bazaar launched in March 2026 to monetize data stolen in ransomware attacks, potentially creating a secondary market; its sustainability is uncertain.
- The article cites the NCA’s 2024 disruption of LockBit as showing that stolen data was not deleted even for victims who paid.
Article Details
- Topic
- AI's role in ransomware business models, including operational efficiency and the monetization of stolen data.
MITRE ATT&CK
Threat Actors
BlackBastaRansomware group whose leaked internal chats discuss using ChatGPT for phishing, debugging persistence tools, and verifying stolen email addresses.Cl0pRansomware group that exploited the MOVEit vulnerability and faced operational challenges managing the resulting volume of victims.fulcrumsecRansomware group that used an LLM to analyze stolen data for leverage during victim negotiations.LockBitRansomware group whose 2024 disruption showed that stolen data was not deleted even for victims who paid.