Hackers Exploit AI Tools to Intensify Ransomware Attacks on European Organizations

European organisations are facing an unprecedented surge in ransomware attacks as cybercriminals increasingly adopt artificial intelligence and sophisticated social engineering tactics to breach defences and accelerate their operations. According to CrowdStrike OverWatch, big game hunting ransomware adversaries have named approximately 2,100 European-based victims on more than 100 dedicated leak sites since January 2024, with Europe now representing the second most targeted region globally after North America.

The threat landscape has evolved through 2025, with attackers combining human ingenuity and technology to streamline operations, including using AI to shorten the time between initial network access and ransomware deployment. SCATTERED SPIDER, one of the region’s most aggressive groups, averaged 35.5 hours between initial access and deployment in 2024, and by mid-2025 this window had shrunk to about 24 hours.

The trend is aided by social engineering such as vishing and CAPTCHA lures like ClickFix, with CrowdStrike identifying over 1,000 CAPTCHA-related incidents impacting European-facing victims during 2024 and 2025. Prominent adversaries include BITWISE SPIDER, PUNK SPIDER, OCULAR SPIDER, TRAVELING SPIDER, and BRAIN SPIDER, active across the period January 2024–September 2025, as UK, Germany, Italy, France and Spain emerged as the most targeted nations.