TrendAI analyst predicts AI will revolutionize ransomware in 2027

TrendAI cybercrime research director Bob McArdle predicted at IRISSCON 2026 in Dublin on November 11, 2026 that AI will revolutionize ransomware in 2027. Infosecurity Magazine reported the prediction.

McArdle said the current ransomware landscape lacks change and is uninteresting to researchers. So far, ransomware actors have mostly used AI to speed up campaigns and make them more efficient. After entering an organization’s environment, attackers use AI tools to locate its most important data. Some ransomware cartels rely on chatbots for the early stages of negotiation.

The ransomware attack process has not changed, spanning initial access brokers through double extortion. AI frameworks such as Artex reduce barriers to initial access by helping attackers quickly locate and exploit vulnerabilities.

He said attackers will compromise every misconfigured or vulnerable internet-connected system. He expects AI-enabled initial access to lower the value of the marketplace for initial access brokers. He expects access brokers to move toward selling privilege escalation to ransomware cartels. Once attackers gain initial access, Artex and AI agents will shorten the kill chain to machine speed.

Businesses are pooling data storage to boost efficiency while expanding AI use for data processing. Centralized data creates new opportunities for threat actors, including extortion threats to interfere with AI orchestration around an organization’s data. AI data processing allows actors to quickly assemble high-value datasets that are simpler to sell to other malicious actors. That opens more profit-making opportunities for ransomware actors.

During 2027, extortion-based ransomware business models will exist alongside data theft and sales models that increase annually. He expects more ransomware groups in the next year because AI simplifies attacks. Large groups will probably take over smaller actors through hostile takeovers as the market fragments. Groups at the Conti and LockBit level might purchase smaller groups to obtain their technology or affiliate networks.