AI Tools Surge in Ransomware Markets, Lowering Entry Barriers
Underground markets are booming with AI-driven tools that put ransomware within reach of almost anyone with a credit card.
Key points
- AI utility posts on dark web forums jumped from 38 in December 2025 to 1,486 by February 2026
- Ransomware attacks have grown 20% since 2023, with smaller enterprises now making up 80% of targets
- Profitability rose 39% between Q1 2025 and Q1 2026, per Rapid7
- Criminal operational security is weaker than it looks: black hats routinely steal from each other
- Halcyon advises enterprises to focus on blocking initial access and disrupting exfiltration
What is actually being sold?
Halcyon's analysis of Telegram channels, twenty dark web forums, and five underground markets found four product categories. First, weaponized large language models (LLMs), stripped of the safety guardrails in legitimate AI, with "WormGPT" the dominant brand, though many sellers under that name simply take payment and deliver nothing. Second, deepfake tools that spoof selfie-based identity checks, also called KYC (know your customer) controls. Third, AI-assisted infrastructure that aggregates and moves stolen data faster. Fourth, hacked AI service accounts, the cheapest and most plentiful category.
Telegram bots handle sales and marketing automatically. Tiered pricing and freemium access mirror legitimate software businesses. AI handles customer service. The operational template isn't improvised; it's borrowed wholesale from the SaaS industry.
Should you worry about smaller enterprises?
Yes, particularly if you run one. Halcyon estimates that 80% of ransomware attacks now target smaller businesses. At Infosecurity Europe, Cynthia Kaiser, SVP of Halcyon's Ransomware Research Center and a former senior figure at the FBI's Cyber Division, told delegates that groups such as Akira operate like vendors, selling exploits and stolen credentials to affiliates the same way a platform company licenses software. The skill floor for would-be attackers has dropped accordingly.
Our piece from 30 May on AI's expanding role in offensive cyber operations flagged exactly this trajectory: scale and automation doing the work that tradecraft once required.
How profitable has this become?
Very. Rapid7 put profitability up 39% between Q1 2025 and Q1 2026. Qilin earned an estimated $193 million between July 2025 and March 2026. The Gentleman, just behind Qilin by Rapid7's estimate, pulled in roughly $52 million over the same period. Thom Langford, CTO EMEA at Rapid7, described the ecosystem as a mature marketplace where initial access, exfiltration, and victim negotiation are each available as standalone contracted services.
Does the sophistication hold up?
Not always. Kaiser noted that criminal OpSec has a visible weakness: rivals steal from rivals. Credentials from one WormGPT instance were lifted by competing criminals and dropped back on the same forum that originally sold them. The market looks polished from the outside; internally it's more chaotic.
Common questions
What should defenders prioritise?
Halcyon points to three layers: stop initial access, catch lateral movement early, and break the exfiltration and encryption chain before data leaves. Tabletop exercises build the muscle memory to do that under pressure, Kaiser added. Law enforcement takedowns help, but they can't be the whole answer.
