“Rise in Ransomware Attacks on European Organizations Fuelled by AI-Powered Hacker Tactics”

European entities are encountering an extraordinary surge of ransomware incursions as cybercriminals increasingly utilize artificial intelligence tools in their schemes.

From January 2024, significant game hunting threat actors have listed around 2,100 victims located in Europe across more than 100 specialized leak sites, reflecting a 13% rise in attacks compared to the previous year.

This region presently constitutes almost 22% of all global ransomware victims monitored, rendering it the second most targeted area following North America.

Companies in the United Kingdom, Germany, Italy, France, and Spain have faced the most intense impact from these incursions, particularly in the manufacturing, professional services, and technology industries.

The escalation in ransomware activities throughout Europe arises from multiple elements that render the area particularly appealing to malicious actors.

Cybercriminals have exploited the European Union’s General Data Protection Regulation, threatening to disclose victims for regulatory breaches during ransom discussions.

The financial motivation remains substantial, with Europe housing five of the ten most valuable companies worldwide, allowing threat actors to demand considerable ransoms based on organizational income.

Furthermore, certain adversaries have indicated political intentions, with select groups aligning with geopolitical disputes and collaborating with hybrid threat actors for mutual advantage.

CrowdStrike analysts observed that adversaries are adopting increasingly intricate strategies to enhance their impact.

Across the reporting timeframe from January 2024 to September 2025, threat actors extensively utilized credential extraction from backup and restore configuration databases, which commonly grant access to hypervisor infrastructure.

The perpetrators frequently launched ransomware from unmonitored systems devoid of endpoint detection and response software, allowing them to remotely encrypt files while sidestepping conventional security protocols.

A particularly alarming development concerns the implementation of Linux ransomware targeting VMware ESXi infrastructure, permitting adversaries to infiltrate entire virtualized environments concurrently.

The underground network facilitating these activities has shown remarkable durability notwithstanding law enforcement interventions.

Russian-language forums such as Exploit and XSS enable collaboration among malicious actors, providing initial access intermediaries, malware-as-a-service creators, and even violence-as-a-service operations.

English-language platforms like BreachForums have established accessible marketplaces where adversaries trade compromised credentials, tools, and intelligence.

These forums implement trust-building strategies including escrow services and reputation systems, fostering a professional criminal economy that lowers entry barriers for aspiring attackers.

Evolution of Attack Techniques and AI Integration

The amalgamation of artificial intelligence capabilities has revolutionized how threat actors execute their operations throughout Europe.

Adversaries are harnessing large language models to develop more persuasive phishing contents and create polymorphic code that avoids signature-based detection measures.

CrowdStrike researchers identified operations where threat actors employed AI-driven tools to automate reconnaissance efforts, allowing them to scan thousands of potential targets and pinpoint vulnerable systems at unparalleled velocity.

The complexity extends to social engineering efforts, where adversaries utilize AI-generated voice synthesis for vishing campaigns that convincingly mimic authentic help desk personnel.

Voice phishing has evolved into a significant threat vector, with nearly 1,000 vishing-related occurrences noted globally during the reporting interval.

While most incidents presently affect North America, CrowdStrike analysts observed that vishing is likely to gain traction in Europe as adversaries recruit native speakers of target languages.

Advanced groups such as SCATTERED SPIDER have exhibited the efficacy of this strategy, averaging just 35.5 hours between initial access and ransomware deployment in 2024, with one incident in mid-2025 compressed to approximately 24 hours.

The adversary’s April 2025 campaign against UK-based retail sectors highlighted the progression of these strategies, including a potential close-access operation aimed at recruiting individuals for onsite Wi-Fi compromise.