TrendAI researcher forecasts AI driven ransomware changes in 2027

TrendAI director of cybercrime research Bob McArdle expects AI to reshape ransomware in 2027, after what he described as a “stagnant” couple of years. Speaking at IRISSCON 2026 in Dublin on 11 November, he said criminals have so far used AI mainly to make existing operations faster and more efficient: for example, to identify valuable data after gaining access to an organisation, or to automate early ransom negotiations with chatbots. He said the broader attack model, from buying access through initial access brokers to using double extortion, had not yet changed significantly.

McArdle expects AI frameworks such as Artex to help attackers find and exploit vulnerabilities more quickly, potentially reducing reliance on brokers who sell access to compromised organisations. He predicted those brokers may instead sell privilege escalation services. AI tools and agents could also shorten the time between initial access and completing an attack.

McArdle said organisations’ growing concentration of data could give criminals new extortion opportunities, including threats to tamper with the AI systems that manage data. He also expects AI to help criminals identify and package valuable stolen data for resale. He forecast that extortion and data sales would increasingly operate side by side during 2027.

McArdle also anticipates more ransomware groups as AI lowers the barriers to carrying out attacks. He said this could prompt larger groups, comparable in scale to Conti and LockBit, to take over smaller operations for their technology or affiliate networks. These are forecasts; the account does not report that the predicted changes or takeovers have already occurred.