The LLM Effect: Why Ransomware in 2026 Is Faster, Smarter, and More Targeted
AI-summarised brief · reviewed before publication
Ransomware attacks have increased, with disclosed incidents rising from 4,900 in 2024 to over 7,200 in 2025. The use of large language models has changed the production cost and polish of attacks, with improvements in social engineering quality and reconnaissance throughput. Average ransom payments have fallen, and exfiltration now appears in roughly three quarters of cases, often before encryption.
💡 Why It Matters
- · Improved social engineering quality makes detection programmes less effective, while expanded operator capabilities increase the threat landscape.