AI-Powered Ransomware: Chatbots Negotiate with Victims

Key Takeaways

1. The Global Group is using chatbots to communicate directly with victims for the first time, automating ransom requests based on encrypted file analysis.

2. Automation allows for continuous negotiations with multiple victims simultaneously, requiring human intervention only in complex situations.

3. The chatbot adjusts its messaging based on the victim’s profile to apply psychological pressure, aiming to hasten ransom payments.

4. The Global Group operates a ransomware-as-a-service model, providing infrastructure and tools while partners carry out attacks, affecting at least 17 companies worldwide.

5. The use of AI by cybercriminals is changing the threat landscape, requiring IT security experts to develop AI-driven solutions to counter automated communication.

---

For the first time ever, the Global Group has started using chatbots to talk directly to its victims. As per Axios, this AI system examines encrypted sample files, checks for successful encryption, and automatically sends out ransom requests.

Automation in Communication

Human intervention is only required when a situation becomes more complicated or escalates. This automated messaging enables continuous negotiations with several affected parties at once, providing a significant level of scalability.

Tailored Psychological Pressure

As reported by Cybersecuritynews, the chatbot customizes the language, tone, and frequency of its messages based on the victim’s profile to increase psychological pressure. When combined with traditional extortion methods, this automated system aims to disturb targets and push them to pay quickly.

The Global Group’s platform has been operational since June 2025. Picus Security suggests that the organization has created a ransomware-as-a-service model, offering the necessary infrastructure, encryption tools, and chatbots while its partners are responsible for infecting target systems. A mobile dashboard is available for operatives to oversee and manage ongoing attacks. Axios highlights that at least 17 companies in the US, UK, Australia, and Brazil have been affected.

The Shift in AI Usage

The use of AI by cybercriminals marks a significant change: artificial intelligence is not just a defensive tool anymore. IT security experts now face the task of quickly recognizing automated communication patterns and responding with their own AI-driven solutions. This situation underscores how dynamic and technologically intricate today’s threat landscape has become.

Source:
Link