AI and cartels drive new ransomware threats – but fewer pay the ransom

Ransomware attacks have taken a new direction in the second quarter of this year, aided by AI-based tools and organized crime cartels. At the same time, the willingness of affected companies to pay ransoms has dropped sharply, a new report from Check Point Research.

The ransomware landscape has changed dramatically in Q2 2025. AI technology is now actively used to generate malware and tailor-made ransom messages. One example of this is the ransomware group Global Group, which sells ”AI-powered negotiation assistance” that automatically adapts extortion tactics to maximize ransom payments. This development means that cybercriminals can quickly scale up their attacks and reach more victims.

At the same time, a new type of ransomware cartels is emerging, with the DragonForce group particularly prominent. Instead of centrally directing attacks, DragonForce gives its affiliates the freedom to choose their own targets and methods, while using the cartel’s advanced ransomware tools and brand. This decentralized structure makes the threats harder to track and combat.

At the same time, companies' willingness to pay is decreasing by around 25 percent, mainly due to better security practices and reduced trust in attackers' promises of data recovery.

– The development is worrying but clear, says Fredrik Sandström, security expert at Check Point Software. AI and the professionalization of cybercriminals are increasing the demands on companies to be even more proactive in their security work.

For more information and the report in its entirety, visit Check Point Software's blog: https://blog.checkpoint.com/re…