AI and cartels drive new ransomware threats – but fewer pay the ransom

Ransomware attacks have taken a new direction in the second quarter of this year, aided by AI-based tools and organized crime cartels. At the same time, the willingness of affected companies to pay ransoms has dropped sharply, a new report from Check Point Research.

In Q2 2025, the ransomware landscape has changed dramatically. AI technology is now actively used to generate malware and tailored extortion messages. One example of this is the ransomware group Global Group, which sells “AI-powered negotiation assistance” that automatically adapts extortion tactics to maximize ransom payments. This development means that Cybercriminals can quickly scale step up their attacks and reach more victims.

At the same time, a new type of ransomware cartels is emerging, in which the DragonForce group stands out in particular. Instead of centrally controlling the attacks, DragonForce gives its affiliates the freedom to choose their own targets and methods, while at the same time uses the cartel's advanced ransomware tools and brand. This Decentralized structure makes threats harder to track and fight.

At the same time, companies' willingness to pay is decreasing by around 25 percent, mainly due to better security practices and reduced trust in attackers' promises of data recovery.

– The development is worrying but clear, says Fredrik Sandström, security expert at Check Point SoftwareAI and the professionalization of cybercriminals are increasing the demands on companies to be even more proactive in their security work.

For more information and the report in its entirety, visit Check Point Software's blog: https://blog.checkpoint.com/re…