Ransomware has been a source of fear, uncertainty, and stress for business leaders since it first emerged in the 1989.

Over the years, this popular form of cyberattack has grown significantly in both sophistication and scale, to where currently it’s the leading cause of data and financial loss for small businesses in 2025. As we get ready for 2026, now is a good time to take stock of how ransomware will continue to evolve in 2026, so that we can better protect ourselves.

Social Engineering Gets More Sophisticated

Ransomware typically finds its way onto your business technology through one of three ways: phishing emails, malicious websites, and system vulnerabilities. Two of those routes are based on tricking your staff into taking an action that allows the criminals access to your network they shouldn’t have.

This form of manipulation is known as “social engineering,” and in the age of large language models, it’s gotten far more dangerous and difficult to detect. Let’s look at how that’s happening.

Traditional signs aren’t working: It used to be that you could spot a phishing email from a mile away. Typos, grammar mistakes, and even nonsensical subject lines were the best that hackers in non-English speaking countries could come up with to try to trick you into clicking.

Image Courtesy: Impreva/Thales Cybersecurity

Now, using ChatGPT, Claude, and other online AI text generators, hackers can easily generate passable, error-free text in any language that they need. This is a sea change in cybersecurity warfare, meaning that once easily recognizable attacks now have a much greater chance of bypassing your protections.

Personalization at scale: With data scraped from the Internet, hackers can customize emails and fake landing pages with information about you and your company that make it much more likely that you’re going to click or take the desired action.

Personalized attacks used to be time- and resource-consuming, often reserved for so called “whaling” attacks that target CEOs or top leaders at big companies. Now, with AI, those targeted, personalized attacks are now being launched at scale, requiring new levels of vigilance

What can you do about it?
AI has gotten more sophisticated, so your team needs to get more sophisticated as well.

Focus on critical thinking and how to analyze suspicious threats, hands-on simulation exercises for LLM generated emails and landing pages, and an increased focus on layered technical defenses that prevent a single click from leading to unfettered network access.

Protecting Operational Technology Becomes a Priority

Because ransomware usually happens on PCs, laptops, and servers, there’s a popular idea that it’s mainly an IT problem but that’s not entirely accurate.

According to operational technology (OT) cyber threat intelligence firm Dragos, they documented 1600 cases of industrial organizations being struck by ransomware last year, as surge of 87% over the year prior.

The reason is simple, hitting OT systems gets them paid faster. It’s also getting easier.

Hackers don’t have to create specific malware that targets these (largely unprotected) programmable logic controllers (PLCs), they know that as the gap between IT and OT shrinks, due to digitization and IoT device deployment, the effects of their attacks will now invariably hit on OT as well.

That means a ransomware attack that brings manufacturing operations to a screeching halt; disrupted physical processes, damaged machinery, and even dangers to your workers’ safety. This leaves overwhelmed company leaders with few good options except to pay the ransomware.

What can you do about it?
The first thing manufacturers must do is better manage the convergence of IT and OT networks.

In my view, the days when companies could blindly follow the path of digitization have ended. Organizations must analyze every intersection between IT and OT to identify risks they pose and then weigh them against the benefits.

Consider segmenting your network to isolate certain types of traffic, so that any ransomware that does slip by your defenses cannot access other types. We’d be happy to

Global Instability Causes More Problems

According to research from the CyberPeace Institute, an overwhelming number of threat actors are connected to three countries: the Russian Federation, Iran, and China. According to their most recent report, those three countries launched over 2,500 ransomware incidents against entities in more than 20 sectors across over 100 countries.

The war in Ukraine and the civil instability in Iran have only heightened these threats.

State-baked Russian and Iranian hacking groups go out searching for new sources of revenue, trying to advance political agendas, and launch damaging attacks against both the United States and Europe as reprisal.

These attacks aren’t just affecting traditional targets for ransomware like government, financial services, and law firms. Interestingly, a recent report from Check Point Research found that globally educational institutions are bearing the brunt of this uptick, a fact that is certainly mirrored by our experience here in Ohio.

Do you remember last year when school districts across central Ohio were struck by a huge breach, or when Ohio University was struck by a succession of data breaches?

Those are just some of the higher profile attacks, there were plenty of others, including an attack on the Union County headquarters. In that attack, criminals made off with social security numbers, passport numbers, and even biometric data like fingerprints.

Smaller, but no less devastating attacks occurred at the village of Golf Manor in Hamilton County.

What do all these attacks have in common? They originated with international hacking groups in countries experiencing political instability.

What can you do about it?
Unfortunately, there’s no silver bullet for this one. The only thing that Ohio businesses can do about this item is to double down on cybersecurity best practices. The list here is long: strong password management, two-factor authentication, regular cyber awareness training, and regular software updates.

Tackle Ransomware with Ohio’s Technology Team

This will be a year of change for businesses across Ohio as they grapple with the rise of artificial intelligence and the increased cybersecurity risk that comes with it. If insecurity or instability around technology is getting in the way of your business goals, it may be time to enlist the help of a trusted technology partner who can help you face those challenges with confidence.

Contact the friendly Astute Technology Management team in Columbus or Cincinnati any time for help!