Year after year, ransomware attacks keep accelerating, and the headlines keep getting louder. But in 2025, ransomware didn’t just accelerate; it evolved. Organizations are now facing an attack landscape that feels fundamentally different.

Ransomware tactics shifting are nothing new. Attackers have always been finding novel ways and new entry paths. However, AI has pushed that evolution into overdrive. Threat actors are now executing attacks at machine speed and exploiting identity weaknesses and vendor relationships with unprecedented precision. As a result, companies are being outpaced before they realize they have been targeted.

Throughout 2025, the numbers tell a stark story. According to a report by Kela, in the first nine months alone, 4,701 ransomware incidents were recorded globally, a 34 percent increase compared to the same period in 2024. However, beyond this sheer scale, what truly defined 2025 was the rise of multi-extortion, offensively deployed AI, and deeply intertwined supply chain breaches, each raising the stakes for organizations across industries.

The Three AI Forces Redefining Ransomware

1. AI Is Accelerating Attacks to Machine Speed—and Making Them Indistinguishable from Legitimate Activity

Until recently, attackers had to conduct reconnaissance, perform well-researched social engineering, mimic targets convincingly, develop malware, and carry out a host of other manual activities. But now, with AI, this entire ransomware chain can be built and executed with minimal effort. This has enabled ransomware operations to move at machine speed and mimic normal user behavior almost flawlessly. What once took attackers days or weeks now happens in minutes. This acceleration lets threat actors target thousands of organizations at once while remaining nearly invisible. And because AI blurs the line between real and fake communication, even well-defended companies often don’t realize they’re under attack until credentials are stolen or systems are already compromised.

2. AI Is Transforming Social Engineering Through Hyper-Realistic Impersonation

Humans have always been the weakest link in cybersecurity, and strong identity controls are often the only safeguard protecting that layer. However, AI has completely upended that. Deepfake voice calls, synthetic video meetings, and AI-generated emails now impersonate people with near-perfect accuracy.

The 25 million dollar Arup incident shows how far this has evolved. A finance employee joined what appeared to be a routine video call with the CFO and senior leaders, unaware that every participant was an AI-generated deepfake. The attackers used real-time synthesized voices and faces to request fraudulent transfers and successfully convinced the employee to send the funds.

This was later described by Arup’s CIO as “technology-enhanced social engineering,” and that is exactly what we are seeing today. Regular social engineering attacks now have an entire AI engine behind them.

3. AI Is Powering Adaptive, Self-Evolving Ransomware Built to Evade Detection

For as long as we have known, cyberattacks or human-driven attacks have followed certain patterns. And malware, no matter how sophisticated, still left behind telltale signs. We could identify these repetitive patterns as suspicious.

AI has transformed this too. AI-driven ransomware now mutates its code autonomously and adjusts tactics depending on the environment in which it lands. These attacks learn from defenses in real time, making them significantly stealthier and harder to contain. Traditional signature-based tools struggle because every instance of the malware may look and behave differently. Therefore, as attackers continue to outpace manual defenses, the traditional security model collapses under the speed and adaptability of AI-driven threats.

How Other Notable Ransomware Trends Are Evolving

1. More Attacks on Critical Sectors

Critical sectors have always been an alluring target for cybercriminals because the value of disruption is enormous and the potential payout is even higher. In 2025, that trend not only continued, but intensified. Nearly half of all ransomware attacks this year targeted critical infrastructure sectors, with 2,332 incidents striking manufacturing, healthcare, energy and government systems.

Manufacturing saw the steepest rise, with attacks surging 61 percent year over year. The attacks on Jaguar Land Rover in August and the disruptions at Bridgestone show how a single incident in manufacturing organizations can paralyze production lines and send shockwaves through global supply chains.

The energy and healthcare sectors suffered similar blows. The energy sector experienced an 80 percent year-over-year increase in ransomware attacks. Earlier this year, Nova Scotia Power was hit by an attack that disrupted communication between power meters and billing systems, forcing the utility to rely on manual readings while attackers exfiltrated customer information. On May 21, Kettering Health faced an Interlock ransomware attack that shut down systems across 14 medical centers and more than 120 outpatient facilities, prompting widespread cancelations.

2. Multi-Extortion Becomes the Default Strategy

Leverage is everything in ransomware attacks, and cybercriminals are doing everything they can to maximize it. In 2025, multistage extortion was no longer an emerging trend. It became the operating model, with ransomware groups widely adopting multi-extortion tactics designed to increase pressure at every stage. By Q3 2025, data theft appeared in 96 percent of disclosed ransomware cases.

The PowerSchool incident shows how paying a ransom offers no real guarantee of safety. In January 2025, the education technology giant paid approximately 2.85 million dollars in Bitcoin after attackers exfiltrated data belonging to more than 62 million individuals across North America. Despite the payment, the attackers later attempted to re-extort individual school districts using the same stolen data, demonstrating a multistage extortion strategy that continues even after the initial ransom is paid.

Because regulatory penalties for data exposure are steep, attackers know that compliance risk can be weaponized. Therefore, even organizations with strong backups remain vulnerable to brand damage and legal consequences.

3. Supply Chain and Third-Party Targeting Intensifies

2025 saw a dramatic rise in supply chain compromises. Instead of attacking enterprises directly, ransomware operators increasingly infiltrated MSPs, SaaS vendors, and software update pipelines. Supply-chain attacks surged 25 percent in April–May 2025 alone, with 63 percent targeting IT, technology, and telecommunications companies. Once inside a vendor, attackers use trusted connections to spread rapidly into downstream organizations.

Healthcare ransomware groups also leaned heavily on vendor compromises to maximize impact. In the first nine months of 2025, attacks on healthcare vendors and service partners rose 30 percent year over year. The Interlock ransomware strain alone breached 2.7 million patient records by exploiting vendors, affecting organizations such as DaVita, Texas Digestive Specialists, Kettering Health, and Naper Grove Vision Care.

One notable example came in April 2025 when Qilin affiliates targeted MSPs by going through their remote management software. They used convincing phishing emails to get in, and once inside, they were able to spread through customer environments and deploy ransomware. This campaign, which has been linked to North Korean actors, shows how criminal and nation-state operations are beginning to overlap. Naturally, it also highlights how quickly a trusted vendor can become the entry point for an attack.

Therefore, protecting only your internal environment is no longer enough. Vendors, integrations, and third-party applications now form critical parts of your attack surface.

Ransomware Protection in 2026

Ransomware defense in 2026 requires a shift from prevention-only thinking to a resilience-driven, identity-first strategy supported by continuous monitoring. With AI-powered ransomware moving faster than human analysts can respond, organizations must now rely on automated detection and response to stay ahead.

Step 1: Build for Resilience

Since cyberattacks are always a matter of when and not if, the foundation of resilience begins with fortified, always available backups that remain usable even if primary systems are compromised. In 2026, this means ensuring backups are immutable, encrypted, and ideally air-gapped to prevent tampering.

It is equally important to insure that recovery is fast and seamless when it is needed. Well-rehearsed incident response playbooks are essential for isolating systems, engaging support teams, and restoring business operations quickly.

Step 2: Strengthen Identity Security

Identity has become the new perimeter, and attackers know it. They increasingly go after credentials, and they use tactics like MFA fatigue, because it is often easier to trick a person than to break a system. Traditional MFA can still fail when attackers mimic real sign-ins or intercept a user’s approval, so relying on it alone is no longer enough.

Organizations now need protections that cannot be easily fooled. Phishing-resistant MFA helps because it removes many of the weak point attackers’ targets. Stronger identity governance insures that people only have the access they truly need, which limits how far attackers can move if they get in. Behavioral monitoring and PAM tools add another layer because they learn what normal activity looks like and can flag actions that do not match, even when the attacker is using valid credentials.

Step 3: Modernize Email & Endpoint Protection

AI-enhanced phishing is getting harder to spot, and attackers no longer rely on simple messages. They use context from real conversations, send QR-based lures, and even deploy deepfake voice calls that sound convincing enough to bypass human intuition. Therefore, email security has to do more than scan for keywords. It must understand intent, recognize impersonation attempts, and notice when a message feels wrong, even if it looks technically clean.

Meanwhile, XDR and MXDR platforms play a critical role, because attacks rarely stay in one place. They collect signals from identity systems, cloud platforms, networks and endpoints, and they bring all of that together to see the story the attacker is trying to hide. In that context, these systems can act on their own, containing suspicious activity before it spreads.

We’re Here to Help Ohio Businesses Stop Ransomware

Ransomware will keep changing, especially as AI becomes part of every stage of the attack. The real task for organizations is learning to adjust just as naturally, strengthening the pieces that matter and staying aware of how threats evolve. There is no perfect defense, but steady, thoughtful improvements go a long way to reduce risk.