Ransomware attacks spike as world distracted by AI

The recorded ransomware volume rose to 799 incidents in July, a jump of roughly 20% from the 668 incidents logged in June. This increase pushed July to the second-busiest month of the year, trailing only March’s 805 attacks. The shift in victim profile was pronounced: attacks on utilities, legal firms and government agencies fell, while finance, technology, pharmaceutical and education targets rose sharply. Finance alone saw a 71% increase, technology 62%, pharmaceutical 46% and education 44%.

Engineers should weigh the ongoing cost of basic controls, enforcing a second authentication factor, keeping software patched, and maintaining regular backups, against the observed rise. These measures address the most common ingress routes cited for the leading gangs, such as stolen credentials or abuse of zero-day vulnerabilities. However, if attackers successfully exploit a previously unknown flaw or obtain valid credentials, those controls may not prevent initial compromise, highlighting where the defenses stop working. The article notes that Comparitech provided no specific ingress data, leaving the exact failure points uncertain.

The prominence of Qilin and The Gentlemen, which together claimed about one-third of July’s victims, shows that a small set of groups can drive a large share of activity. Their methodologies, credential theft for The Gentlemen and zero-day use for Qilin as reported, reinforce that attackers rely on established techniques rather than novel AI-only methods. Consequently, diverting resources exclusively to AI-focused threats may leave gaps in defending against these proven vectors. Maintaining a balanced security posture that covers both legacy and emerging risks remains the prudent approach.