How Modern Ransomware Groups Use AI and Psychological Pressure to Escalate Extortion Tactics
Qilin’s Attack on Keio Railway Signals a New Phase
International hacking group Qilin claimed responsibility for a ransomware attack on subsidiaries of Keio Railway in late September 2026, publishing internal documents and a countdown threatening to release stolen data. The attack disrupted reservation services and email systems across parts of the group, according to the railway operator’s statement on October 16. This incident reflects a broader shift in ransomware tactics, where groups now combine data theft with psychological pressure to force payments.
From Encryption to Multi-Layered Extortion
Ransomware has evolved from simple file encryption to operations that exfiltrate data and threaten public release. The concept of cryptoviral extortion was first presented at a 1996 IEEE Security & Privacy conference by Young and Yung. Today, attackers use both encryption and data leaks to increase leverage. Ransomware payments reached a record $1.25 billion in 2023 before dropping to $813 million in 2024, according to Statista and FBI data cited in Wikipedia. The decline is attributed to victims refusing to pay and increased law enforcement action.
AI Lowers the Barrier for Sophisticated Attacks
Artificial intelligence is now embedded in the majority of ransomware campaigns. According to a 2026 Ransomware Risk Report by Semperis, 84% of surveyed victims said attackers exploited AI in their incidents. Forty-four percent reported that attackers specifically used the victims’ own AI systems against them. AI enables autonomous attacks, reducing the need for direct human involvement. Chris Inglis, former White House National Cyber Director, said AI allows individuals without technical expertise to launch sophisticated intrusions by instructing AI systems to identify weaknesses and tailor social engineering schemes. He noted that autonomous ransomware attacks are already a reality.
Psychological Pressure Replaces Purely Technical Threats
Beyond data theft, ransomware groups now target individuals to increase pressure. More than a third of surveyed victims faced psychological or physical threats against employees. Fourteen percent of organizations reported that employees or family members were forced to change jobs, residences, or office locations due to sustained threats. Inglis warned that attackers use AI to readjust tactics as defenders react, making defenses harder to sustain. Eighty-seven percent of attacks targeted identity systems, which control access to corporate networks, showing a focus on maximizing disruption.
Global Trends Show Persistent Threat Despite Payment Drops
Although ransomware payments declined in 2024, the threat remains widespread. Sixty-nine percent of surveyed victims experienced multiple successful attacks within a single year. Globally, there were about 623 million ransomware attacks in 2021 and 493 million in 2022, according to Statista. The use of AI and psychological tactics marks a shift from earlier models that relied solely on encryption. Groups like Qilin now operate with a blend of technical automation and human intimidation, reflecting a maturing criminal enterprise that adapts faster than traditional defenses.
AI-Driven Social Engineering Amplifies Psychological Leverage
Artificial intelligence enables ransomware groups to tailor social engineering schemes to specific employees, increasing the effectiveness of psychological pressure. According to Chris Inglis, former White House National Cyber Director, AI allows attackers to quickly identify weaknesses and adjust tactics as defenders react, making defenses harder to sustain. This adaptive capability means attackers can refine their approach in real time, exploiting human vulnerabilities with precision.
By leveraging AI, criminals can craft highly personalized messages that mimic trusted contacts or internal communications, tricking employees into revealing credentials or executing malicious actions. Inglis noted that this use of AI does not require advanced technical skills, as individuals can instruct AI systems to generate convincing lures and automate intrusion attempts. The technology thus lowers the barrier for launching sophisticated attacks while amplifying their impact.
These AI-enhanced tactics contribute to the broader trend where more than a third of surveyed victims faced psychological or physical threats against employees, and 14% reported that staff or family members were compelled to change jobs, residences, or office locations due to sustained pressure. The integration of AI into social engineering represents a significant evolution in how ransomware groups combine technical automation with human intimidation to maximize extortion success.
AI Lowers the Barrier for Sophisticated Attacks
Artificial intelligence is now embedded in the majority of ransomware campaigns. According to a 2026 Ransomware Risk Report by Semperis, 84% of surveyed victims said attackers exploited AI in their incidents. Forty-four percent reported that attackers specifically used the victims’ own AI systems against them. AI enables autonomous attacks, reducing the need for direct human involvement. Chris Inglis, former White House National Cyber Director, said AI allows individuals without technical expertise to launch sophisticated intrusions by instructing AI systems to identify weaknesses and tailor social engineering schemes. He noted that autonomous ransomware attacks are already a reality.
Psychological Pressure Replaces Purely Technical Threats
Beyond data theft, ransomware groups now target individuals to increase pressure. More than a third of surveyed victims faced psychological or physical threats against employees. Fourteen percent of organizations reported that employees or family members were forced to change jobs, residences, or office locations due to sustained threats. Inglis warned that attackers use AI to readjust tactics as defenders react, making defenses harder to sustain. Eighty-seven percent of attacks targeted identity systems, which control access to corporate networks, showing a focus on maximizing disruption.
Why Traditional Perimeter Defenses Struggle Against AI-Assisted Intrusions
Traditional security models often rely on static perimeters, but the integration of artificial intelligence into ransomware campaigns has fundamentally altered the threat landscape. According to the 2026 Ransomware Risk Report by Semperis, 87% of attacks now target identity systems, which serve as the digital infrastructure controlling access to corporate networks. By focusing on these core access points, attackers bypass conventional barriers designed to keep intruders out of the broader network environment.
Chris Inglis, former White House National Cyber Director, notes that AI grants attackers the ability to identify system weaknesses and readjust their tactics in real time as defenders attempt to react. This adaptive capability creates a significant disadvantage for organizations relying on legacy defenses, as the AI-driven approach allows criminals to automate intrusions and scale their efforts. Because AI can be used to write malicious code or tailor social engineering schemes without requiring deep technical expertise, the barrier for launching sophisticated, persistent threats is significantly lowered, making it increasingly difficult for traditional security measures to maintain effective protection.
Sources
- Qilin Threatens to Release Data Stolen in Keio Railway Cyberattack
- Ransomware
- AI linked to 84% of ransomware attacks, new report finds
Photo: Tamatak 'v chamatak ki (Public domain)
