Key Findings
In 2026, ransomware operators started handing the attack itself to AI agents.
AI Agents Run Inside Live Ransomware Operations
Three separate ransomware-linked operations ran AI agents in production.
Humans Approve, AI Does the Volume
Operators approve. The AI plans, runs tools and writes the code.
The AI Kit Is Sold Like RaaS
Agents and playbooks are packaged for new affiliates.
Edge Devices at Machine Scale
Thousands of firewalls and VPNs tested at machine speed.
Safeguards Slow Them Down, Not Stop Them
Fake authorizations, jailbreaks and uncensored models kept them running.
AI-Written Ransomware Still Breaks
Broken encryptors and reused keys open recovery paths.
What Is Agentic Ransomware?
Agentic ransomware is ransomware where AI agents do the hands-on work: choosing techniques, running tools and writing code, within limits a human sets. It goes beyond criminal chatbots such as WormGPT, marking the shift from human-operated to AI-operated attacks within the wider rise of agentic AI.
The agent plans, runs the tools and writes the code. The operator approves.
One Year of Agentic Ransomware
In less than a year, AI agents moved from building access for ransomware brands to running live encryption and extortion campaigns.
Access at Scale
Credentials harvested from tens of thousands of Fortinet firewalls
Agents Join the Supply Chain
14 AI agents build access for Lynx and INC
AI Reaches Encryption
An AI co-operator takes intrusions to live encryption
AI Runs the Extortion
An AI coding agent powers n0n's leak waves
Agentic Kits for Affiliates
AI attack stacks packaged for new partners
Three Agentic Ransomware Operations
Three operations, three points in the ransomware supply chain.
Case 1INC & The Gentlemen
- How AI Was Used
- AI runs the attack, human approves
- What the AI Did
- Planned each intrusion, ran the tools, sorted stolen data and drafted ransom demands
- Outcome
- Encryptors staged for six victims and live encryption observed
Case 2n0n
- How AI Was Used
- AI co-developer, human-directed
- What the AI Did
- Wrote and fixed hundreds of attack scripts, the encryptor and the extortion emails
- Outcome
- Encryption or data destruction across at least 23 organizations
Case 3FortiBleed
- How AI Was Used
- Team of 14 AI agents
- What the AI Did
- Hunted for weaknesses and built the tools that validated stolen firewall credentials
- Outcome
- Access to 86,644 Fortinet devices, built for Lynx and INC ransomware
INC and The Gentlemen: An AI Co-Operator for Ransomware Affiliates
INC and The Gentlemen affiliates ran intrusions through an AI stack that planned each step, ran the tools and drafted ransom demands, with the operator approving. The kit was also packaged for other affiliates.
Full report →
MITRE ATT&CK
n0n: Agentic Ransomware With an AI Co-Developer
The n0n operator used an AI coding agent as its developer: it wrote the attack scripts and the encryptor, ran the C2 panel and patched a broken encryptor mid-attack, mostly on uncensored models.
Full report →
MITRE ATT&CK
FortiBleed: AI Agents Building Access for Ransomware
A Lynx and INC affiliate ran 14 AI agents to harvest and validate Fortinet firewall credentials, an access inventory built for ransomware.
Full report →
MITRE ATT&CK
Who Agentic Ransomware Hit
Victims on every inhabited continent. Switch operations to compare.
How Deep the Operators Got
n0n Operator Outcomes
Attackers Run on AI. Some of It May Be Yours.
97 attacker servers held stolen AI keys. Check whether your AI accounts are exposed.
How AI Agents Change the Ransomware Lifecycle
One AI-supported workflow replaces the access broker, the developer and the negotiator.
Find Targets
Scans exposed devices, profiles victims
Break In
Tests stolen logins and exploits at speed
Build the Tools
Writes and fixes attack code
Spread Inside
Maps the network, harvests credentials
Encrypt or Destroy
Builds encryptors or wipes backups
Extort
Prices the ransom, writes the pressure
How They Got Past AI Safeguards
- Fake red team authorizations
- "WormGPT" persona prompts
- Purchased jailbreaks
- Uncensored and self-hosted models
Where the Agents Failed
- Encryptors broke mid-attack
- Keys reused across victims
- Demand sent to the wrong company
- AI logs exposed the whole campaign
Agentic AI Across Attacker Infrastructure
SOCRadar telemetry from 11,541 exposed attacker servers (Sep 2025 to Oct 2026, all threat types).
From Exposed Servers to Autonomous Operations
How Far AI Is in the Loop
Victim Data on Attacker Servers
An observed association, not proof that AI caused more compromise.
Agent Tooling on Attacker Servers
Where AI Supports the Kill Chain
AI clusters at the front of the kill chain. The three ransomware cases carry it through to encryption and extortion.
What Comes Next for Agentic Ransomware
Agentic Ransomware Will Spread Through the Affiliate Model
AI kits travel the way RaaS encryptors do.
Model Safeguards Will Not Be the Deciding Control
Every operator got around refusals. Defend the access paths.
Edge Devices and Credentials Remain the Entry Point
Agents make mass credential testing cheap.
AI Artifacts Will Become a Primary Intelligence Source
AI logs exposed these operations, until attackers learn to scrub them.
How to Defend Against Agentic Ransomware
Lock Down Edge Devices
Patch Fortinet and SonicWall, hide management interfaces.
Kill Credential Reuse
Rotate VPN and admin passwords, enforce phishing-resistant MFA.
Harden MSP and RMM Access
MFA and allowlists on remote-management tools.
Shorten Cloud Key Lifetimes
Short-lived roles, alerts on bulk storage deletes.
Guard Security Consoles
Allowlist firewall managers, alert on mass policy changes.
Protect Active Directory
Patch Zerologon, tier admins, watch replication.
Keep Backups Out of Reach
Immutable or offline backups.
Watch Exfiltration Paths
Monitor uploads to cloud storage.
Check Before You Rebuild
Reused keys and failed encryption may allow recovery.
1 Hacker. 1,000 Targets. The Rise of Agentic Cyberattacks
SOCRadar CISO Ensar Şeker and Yasmin Abdelmajied show how AI agents automate the attack chain, and how defenders can detect and stop these attacks. 15:00 UTC, 30 minutes.
