Fraud Management & Cybercrime
,
Ransomware
Cybercriminals Use Artificial Intelligence and Physical Threats to Maximize Impact
One-dimensional data encryption threats have morphed into more dangerous, multi-layered ransomware attacks that are expanding in scope and impact, creating an urgent need for organizations to fortify their defenses.
Threat actors often work to weaponize stolen intellectual property, target executives for extortion and may even choose strategic moments to launch additional cyberattacks designed to maximize disruption.
Verizon’s 2024 Data Breach Investigations Report found a 180% increase in the exploitation of vulnerabilities as the critical path to initiate a breach. Attacks were primarily leveraged by ransomware and other extortion-related threat actors, especially through zero-day exploits.
This trend aligns with recent research highlighted in the Ransomware Task Force’s Global Ransomware Incident Map, which cited a 73% increase in ransomware incidents in 2023 compared to 2022, driven largely by attacks involving double and triple extortion.
The rise of ransomware as a service, or RaaS, gives even low-skilled cybercriminals the tools they need to carry out sophisticated campaigns. RaaS platforms, including DarkSide, provide ready-made ransomware kits, enabling nearly anyone with malicious intent to launch an attack. One recent attack by the CL0P ransomware group exploited zero-day vulnerabilities in the MOVEit Transfer tool, affecting thousands of organizations and demonstrating how accessible such tools actually are. As RaaS models grow more modular and automated, industry observers expect targeted attacks to rise.
Even more alarming is the emergence of violence as a service, or VaaS, in which threat actors use physical intimidation to expedite ransom payments. VaaS incidents tend to involve cybercriminals or their affiliates threatening violence to push victims into compliance.
AI Intensifies Ransomware Capabilities
AI is now being used to amplify ransomware attacks, enabling criminals to optimize tactics from targeting to exfiltration. According to the European Union Agency for Network and Information Security’s Threat Landscape 2024 report, ransomware groups and other cybercriminals are using AI-driven phishing campaigns, software supply chain attacks and malware that evades detection to strengthen their attacks.
AI-driven ransomware is expected to become increasingly adaptive. Research from the U.K.’s National Cyber Security Centre warns that as AI is further embedded into ransomware tactics, security leaders must prepare by adopting more proactive, AI-powered defensive capabilities.
Multi-Layered Extortion Tactics
Cybercriminals are amplifying their impact through increasingly layered extortion strategies. In double and triple extortion attacks, attackers demand additional payments to prevent the release of sensitive data while pressuring victims through customers, partners or regulators. In many cases, threat actors now add data theft or public shaming to strengthen ransom demands.
Another development is the trend toward quadruple extortion in which threat actors escalate attacks by launching multiple cyber or physical attacks if initial demands are not met. Threat actors may launch a distributed denial-of-service attack to further disrupt a victim organization’s operations and also threaten secondary attacks targeting customers or partners. By broadening the scope of their attacks, threat actors can inflict significant financial and reputational damage, particularly in high-stakes industries.
In light of the escalating tactics, CISOs need comprehensive, multi-layered defensive strategies that extend to protect partners, customers and the broader ecosystem. Elements such as secure backup protocols and incident response plans can help contain ransomware attacks and address the potential for operational impact.
Ransomware’s Rising Impact on Cyber Insurance
Cyber insurance data indicates ransomware’s rising impact. Cyber insurance carrier Coalition examined claim trends in its 2024 Cyber Claims Report and found that ransomware claim severity increased by 68% in the first half of 2024, with an average loss reaching $353,000.
Cyber insurance providers are grappling with higher claim costs due to the complex nature of modern ransomware incidents, which may include ransom payments, data recovery and business interruption expenses. As cyber insurance premiums rise, robust ransomware defenses become increasingly essential for organizations seeking affordable coverage.
Organizations that use proactive defenses may be viewed as potentially lower risk clients by insurers. Forward-thinking CISOs should consider aligning their cybersecurity strategies with insurance requirements to help maintain adequate cyber insurance coverage.