How Artificial Intelligence Is Being Used by Both Ransomware Attackers and Defenders

It doesn’t exactly qualify as breaking news to say that Artificial Intelligence is everywhere. Most organizations have adopted—or are in the process of adopting—AI technology to a greater or lesser degree.

This includes companies that exist to attack other companies via ransomware. AI, of course, is a neutral technology. Like the Internet itself, it can be used for good or evil. That’s why it’s important to learn how both sides are using AI to fend off ransomware attacks as well as launch and support those same attacks.

🤖🎣 Better Phishing Lures

In its early days, ransomware attacks were usually easy to spot. Attackers would push poorly-worded, typo-strewn phishing emails across the Internet into inboxes, hoping to lure users into clicking a malicious link or download a lethal attachment.

But AI is polishing those emails up, making them much more professional and personal—masking its true intentions much better, and claiming more victims.

These burgeoning attempts are increasingly using AI to scrape data from social media or public records, making spear-phishing campaigns more effective.

Another of AI’s key abilities—automation—is being used to power parts of the attack chain. It can create ransomware that changes encryption tactics based on the defenses it encounters.

Agentic AI can even take human-like actions: one emerging threat is AI chatbots, which are being used to negotiate ransom payments, making their extortion operations more scalable and lucrative.

🛡️ Using AI’s Powers for Good

It sounds terrifying, and with good reason. But the Bad Guys aren’t the only ones leveraging AI. Security teams are employing it to protect their organizations’ crown jewels.

It starts with AI-driven threat detection, since keeping the barbarians behind the gate, instead of catching them on the inside, is every company’s goal. 

Going beyond relying solely on signature-based tools that look for known malware, AI can analyze vast amounts of network traffic and endpoint data to spot unusual behavior, like an avalanche of logon attempts or a user suddenly accessing thousands of files at once. These anomalies can trigger alerts before ransomware has a chance to spread.

And it all happens faster than any human or non-AI technology can possibly operate—this is essential, since the attackers are working at the same speed.

That speed is crucial when it comes to automated responses. If suspicious ransomware activity is detected, AI systems can take multiple actions, like:

• Quarantining an endpoint
• Cutting off network access
• Rolling back malicious changes automatically

Remember the earlier warning about the improvement in phishing emails? That sword cuts both ways, as AI is also improving phishing defense. Security tools now commonly use machine learning to analyze incoming email, including content, headers, links, metadata, and sender behavior. This helps quickly spot dangerous patterns.

🦾 Power to the People

It’s clear that the arms race between AI-enabled attackers and defenders is continuing to ratchet up. As the AI models themselves become more powerful and sophisticated, the ransomware using it will follow suit. But the same is true for the defenders, who will get access to better and faster tools for prevention, detection, and response.

What is likely to be true in the future is exactly what’s true today: the organizations that prepare properly for ransomware attacks, including possibly the most important factor of all—ongoing user training—will be best able to stop the criminals from getting inside the network and wreaking havoc. AI is simply a tool—a powerful tool, but a tool nonetheless. People, as always, will mean the difference between success and failure.