Ransomware will be revolutionized in 2027 due to the influence of AI, with threat actors poised to become more innovative, according TrendAI’s director of cybercrime research, Bob McArdle.
“Ransomware has been pretty stagnant and boring for the past couple of years, at least if you’re a researcher like me,” he told the audience at the IRISSCON 2026 conference in Dublin, Ireland, on November 11.
To date, ransomware actors have primarily used AI to enhance the speed and efficiency of campaigns. This includes the use of AI tools to identify the most important data once inside an organization’s environment, while some groups have deployed chatbots to carry out the initial negotiation stages on their behalf.
However, the overall process of ransomware attacks, from the use of initial access brokers through to the double-extortion method, have not changed.
“That’s a drop in the ocean compared to where we’re going with ransomware next,” McArdle warned.
Devaluation of the Initial Access Broker Marketplace
One expected change is around how initial access is gained to victim’s environments. In the current ransomware-as-a-service (RaaS) ecosystem, initial access brokers typically sell access to affiliates through techniques like compromised vulnerabilities and stolen credentials.
However, McArdle noted that AI frameworks like Artex are removing barriers to entry for entry for initial access, by enabling attackers to identify and exploit vulnerabilities rapidly.
“Anything that’s connected to the internet and is misconfigured or has vulnerabilities will be compromised,” he commented.
This will devalue the initial access market and, as a result, McArdle expects brokers to adapt their business model towards offering privilege escalation to ransomware groups.
Post initial access, tools like Artex and AI agents will allow attackers to shrink down the “kill chain” to machine speed.
McArdle also observed that many organizations are centralizing their data storage, which is good for business efficiency purposes amid the growing use of AI for data processing.
However, this centralization will provide new opportunities for threat actors. This includes ransomware groups threatening to tamper with the AI orchestration around organizations’ data as a further extortion technique.
Another area in which AI will benefit ransomware groups is its ability to process data effectively, enabling actors to quickly develop datasets of high value data, which will be easier to sell on to other malicious actors. This approach will provide even more profit-making opportunities for these actors.
“Over 2027, we will start seeing an inflection point where you have extortion-based business models of ransomware living side-by-side with the actual data theft and sales models increasing every year,” McArdle explained.
Hostile Takeovers by Ransomware Groups
With AI making ransomware attacks easier to undertake, McArdle expects to see a growth in the number of ransomware groups in the next year.
This further fragmentation of the ransomware ecosystem will likely lead to large groups frequently undertaking “hostile takeovers” of smaller actors.
“We will start seeing Conti and LockBit level groups effectively acquiring smaller groups for their technology or even just their affiliate networks,” he added.
