The era of AI ransomware has arrived: how cybercriminals use artificial intelligence

Generative AI in the hands of intruders

Cybersecurity has entered a new, alarming phase: attackers are increasingly using generative artificial intelligence to create and distribute ransomware. According to researchers at Anthropic, an AI company specializing in AI, AI—based attacks are no longer a theory - they occur in real time.

Moreover, AI is used not only to automate individual steps, but also to fully develop malicious code, including cryptographers, packagers, and distribution mechanisms.

New threats: from automation to accessibility

Previously, the creation of complex ransomware programs required high qualifications. Today, generative AI allows even inexperienced attackers to generate effective malware in a matter of minutes. It is enough to enter a text query, and the model creates a working code optimized to bypass antiviruses and maximize system damage.

This dramatically lowers the threshold for entry into cybercrime, increasing the number of potential attacks and their geographical spread.

Cybercrime by subscription: AI as a service

Anthropic has documented cases where attackers offer "custom-made ransomware creation services" using AI. These offers appear on shadow forums: the customer uploads the requirements, and the seller, using AI, generates a personalized virus that encrypts the data and demands a ransom.

This approach turns cybercrime into a scalable business, where AI acts as a "co-author" of crimes.

How to protect yourself in the new reality

Traditional threat signature-based defenses are becoming less effective against AI-generated attacks that are easily modified. A transition to behavioral analysis, AI anomaly detection, and multi-level security systems is needed.

The key measures are:

• Updating IT infrastructure and security systems
• Employee training in phishing and suspicious activity recognition
• Regular data backup
• Implementation of AI solutions for threat detection

Security can no longer outpace threats — it must outpace their speed.

Hackers and defenders in the age of AI: who will deceive whom?

Artificial intelligence (AI) has long ceased to be just the technology of the future — it is already here, and is actively used in one of the most intense digital confrontations: between hackers and cybersecurity experts. In fact, both have entered into a real arms race, where the main trump card is the ability to learn faster, disguise and attack.

Previously, cyber attacks were often based on patterns: phishing emails with grammatical errors, fake websites with suspicious addresses. Now everything is different. Attackers use AI to generate phishing messages that perfectly mimic the communication style of colleagues or management. These emails sound natural, don't arouse suspicion, and work much more effectively.

But this is just the beginning. AI helps hackers:

- Automate the search for vulnerabilities in systems.

- Create fake voices and videos (deepfakes) to deceive employees or gain access.

- Disguise malware as legitimate programs.

- Adapt real-time attacks to bypass defenses.

On the other hand, companies responsible for cybersecurity are also not sitting idly by. They use AI to:

- Analyzing huge amounts of data and detecting anomalies.

- Predicting attacks based on network behavior.

- Rapid response to incidents — sometimes faster than a human can do.

It turns out that both "criminals" and "good guys" use the same technology. There is a difference in goals: some want to steal data, paralyze systems, or extort money, while others want to protect infrastructure, business, and privacy.

Of particular concern is the use of AI by foreign intelligence agencies. Government hacker groups are increasingly using AI to conduct targeted, covert, and long—term operations ranging from industrial espionage to interference in critical systems.

As a result, the smarter the AI gets, the higher the stakes. Now the struggle is not only between people, but also between algorithms. And the one whose AI learns faster, adapts faster, and anticipates the opponent's moves will win.

The Russian military in Ukraine is under threat: spyware disguises itself as a popular application

Russian soldiers operating in Ukraine are facing a new threat to cybersecurity. The attackers are distributing a modified version of the popular Alpine Quest application, which was originally designed to work with topographic maps. However, this version contains malicious software Android.Spy.1292.origin, capable of collecting confidential data from devices and transferring it to remote command and control servers (C2).

After installing the fake version of Alpine Quest, the malware is imperceptibly activated and begins interacting with the remote C2 server. It collects a wide range of data, including the device's current geolocation, downloaded files, phone numbers, address lists, and even GPS locLog logs created by Alpine Quest itself. A particular danger is the possibility of extracting documents exchanged through messengers such as Telegram and WhatsApp.

This is just the beginning. The Trojan can also download and run additional modules, expanding its capabilities for data theft. Given that the Russian military often uses mobile devices to coordinate actions and exchange information, the consequences of such an attack can be catastrophic.

Alpine Quest is a legal application that is widely used by tourists, hunters and the military to work with topographic maps. His popularity among Russian soldiers deployed in combat zones makes him an ideal "bait" for intruders. The fake version of the application is distributed through unknown channels, which makes it difficult to identify the source of the attack.

The collected data can be used by opponents to determine the location of military units, analyze their operations, and plan a response. This is especially dangerous in conditions of active hostilities, where the accuracy of information plays a key role. In addition, leaking confidential documents can compromise strategic plans and tactical decisions.

To minimize risks, experts recommend that military personnel refrain from using third-party applications on their devices, especially if they are downloaded from unverified sources. It is also important to update the software regularly and use reliable antivirus solutions. Military organizations should provide cybersecurity training to increase personnel awareness of potential threats.