"Ransomware has been pretty stagnant and boring for the past couple of years, at least if you’re a researcher like me," Bob McArdle told the audience at IRISSCON 2026 in Dublin on November 11. He warned that 2027 will be a turning point: artificial intelligence, already used to speed and streamline campaigns, is poised to remake how ransomware is conducted and monetized.
Bob McArdle’s central claim at IRISSCON 2026
McArdle, identified in coverage as TrendAI’s director of cybercrime research, described current ransomware behavior as largely iterative: actors have used AI to accelerate reconnaissance inside victim environments, to surface the most valuable data, and to automate early-stage negotiations with chatbots. Yet he emphasized that the broad architecture of attacks — from initial access brokers through double-extortion tactics — has not fundamentally changed, until now.
Artex and the devaluation of the initial access broker marketplace
One concrete change McArdle singled out is how AI frameworks such as Artex lower barriers to initial access. Where initial access brokers have traditionally sold footholds produced by stolen credentials or exploited vulnerabilities, McArdle said AI tools are enabling attackers to find and exploit vulnerabilities rapidly. As a result, he predicts the initial access market will be devalued and that brokers will adapt by offering privilege escalation services to ransomware groups rather than simple access.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleShrinking the kill chain to machine speed
Post-access, McArdle said, AI agents and tools like Artex will compress what used to be a lengthy intruder "kill chain" down to machine speed. That change is more than incremental: automating lateral movement, discovery and high-value data identification at machine timescales means an attacker can complete stages of an intrusion far faster than human operators could — a shift McArdle framed as a key component of the coming revolution.
Centralized data, AI orchestration, and new extortion levers
McArdle also noted that many organizations are centralizing their data to support AI processing. While centralized storage can be efficient for business uses of AI, he warned it creates new targets: threat actors could threaten to tamper with an organization’s AI orchestration around its data as an additional extortion technique. Separately, McArdle said AI’s data-processing power will let attackers quickly assemble high-value datasets that are easier to sell to other malicious actors, increasing the profitability of pure data-theft and resale models.
Extortion business models will coexist with data-theft sales in 2027
Looking ahead to 2027, McArdle forecast an inflection point: "Over 2027, we will start seeing an inflection point where you have extortion-based business models of ransomware living side-by-side with the actual data theft and sales models increasing every year." In his view, AI both magnifies the upside for extortion and accelerates the production of monetizable datasets for resale — effectively broadening the revenue streams available to criminals.
Hostile takeovers among ransomware groups and market fragmentation
McArdle expects the overall number of ransomware groups to grow as AI lowers the skill and resource thresholds for entry. That fragmentation, he said, will prompt large groups to engage in "hostile takeovers" of smaller actors. He explicitly invoked "Conti and LockBit level groups effectively acquiring smaller groups for their technology or even just their affiliate networks," forecasting consolidation by acquisition of talent, tools or partner networks.
How technologists, affected enterprises, and ransomware groups are likely to react
- Technologists and security teams will be confronting faster intrusions as AI agents shrink the kill chain and frameworks such as Artex automate vulnerability discovery — a dynamic McArdle ties directly to the anticipated devaluation of the initial access market.
- Affected enterprises and procurement leaders that centralize data to enable AI processing should watch for new extortion vectors tied to AI orchestration, since McArdle warned centralized storage creates fresh opportunities for attackers to threaten tampering.
- Ransomware groups and initial access brokers are, in McArdle’s telling, likely to alter business models: brokers may pivot toward selling privilege escalation while larger ransomware groups may acquire smaller ones for technology or affiliate networks as fragmentation increases.
McArdle’s remarks sketch a concrete, short-term trajectory: AI that has so far sped familiar ransomware operations will, according to his forecast, change who gets access, how quickly intrusions proceed, and how criminals monetize stolen material. The question his talk leaves most stark is whether the projected 2027 inflection — where extortion and data-sales coexist and large groups consolidate smaller ones — will materialize as predicted or be slowed by changes in defensive posture and law enforcement approaches. The coming year should make that answer much clearer.
Original reporting: https://www.infosecurity-magazine.com/news/ai-revolutionize-ransomware/
