Rise in AI-Enhanced Ransomware Attacks

Dragos recently shared troubling data highlighting a rise in ransomware attacks, driven by AI-enhanced strategies. These cybercriminals intensified their focus on industrial sectors in early 2025, blending new and old tactics to exploit their targets.

Notorious groups like Cl0p, Akira, and RansomHub continued their aggressive campaigns, while newcomers such as FunkSec, Sarcoma, and Lynx used AI-based malware and cutting-edge evasion techniques to bypass endpoint security. These attackers primarily targeted vulnerabilities in IT infrastructure, including Managed File Transfer (MFT) systems, remote access devices, and unpatched software, leading to widespread disruptions across industries.

Targeted Industries and Rising Threat

Abdulrahman H. Alamri from Dragos pointed out that manufacturing, transportation, and industrial control systems were prime targets. Attackers exploited weaknesses in remote access security, credential management, and supply chain vulnerabilities, complicating incident response efforts. During this period, Dragos documented a jump to 708 ransomware incidents in industrial settings globally, up from roughly 600 previously. North America’s incidents rose from 360 to 413, with Europe following suit.

Manufacturing suffered the most, accounting for 68% of attacks. Interestingly, no new ransomware variants specifically targeting industrial control systems emerged, but incidents like the South African Weather Service outage underline the potential widespread impact.

Evolving Ransomware Tactics

Ransomware groups have evolved, turning to AI-assisted malware and new extortion strategies that press victims without encryption. Cl0p, in particular, exploited Cleo MFT software flaws, with their incidents surging from two last quarter of 2024 to 154 in early 2025.

Emerging groups like FunkSec, NightSpire, and Kairos added complexity, targeting industrial and corporate sectors with advanced operations. The convergence of IT and operational technology has added challenges, as disruptions in IT spill into operational environments.

Criminals now use AI tools to enhance phishing campaigns, making them harder to detect. By exploiting weakly secured credentials, they breach networks and extend their reach across critical systems.

Strengthening Cybersecurity Measures

In response to these threats, organizations must strengthen their cybersecurity protocols. Implementing robust multi-factor authentication, vigilant network monitoring, secure offline backups, and improving remote access controls are essential steps. Training personnel, assessing network vulnerabilities, and integrating AI-driven security solutions are critical for combating these advanced threats.

Addressing vulnerabilities from IT and operational systems’ integration remains a priority. Alamri emphasized the importance of proactive strategies, information sharing, and fortifying defenses to mitigate the persistent risks of ransomware.

**Qsentinel offers state-of-the-art security solutions to keep your organization protected from ransomware attacks. Stay ahead with us.**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.