Proofpoint 2026 AI-Era Ransomware Report: 65% of Victims Report AI Increased Attack Effectiveness

Key facts for Proofpoint AI-era ransomware survey

Detection coverage for Proofpoint AI-era ransomware survey

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1702 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Mass Data Staging, Archive-and-Encrypt Sequence, and Outbound Transfer (Pre-Encryption Data Theft / Double-Extortion Impact)

Detects the tar-archive-then-openssl-encrypt sequence run on the same host within a short window and correlates it with a subsequent large outbound transfer to an external destination — the pre-encryption data-theft and impact pattern Proofpoint's report finds in 65-83% of ransomware incidents, which precedes the ~37% second-extortion-demand outcome.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1005, T1567, T1486, T1657, T1199
• Data sources: linux_auditd, sysmon_network / DeviceNetworkEvents, proxy/firewall (Palo Alto / Zscaler traffic logs)
• Severity: critical
• Confidence: high

Splunk SPL

index=linux_auditd sourcetype="linux:audit" ((comm="tar" CommandLine="*-czf*") OR (comm="openssl" CommandLine="*enc*" CommandLine="*aes-256-cbc*"))
| eval stage_type=if(comm="tar","archive","encrypt")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, values(CommandLine) as commands, dc(stage_type) as stage_variety by host, user
| where stage_variety=2 AND (last_seen-first_seen) < 300
| join type=left host
    [ search index=network (sourcetype="pan:traffic" OR sourcetype="zscaler:web") dest_port IN (443,80) bytes_out > 50000000
      | stats sum(bytes_out) as total_bytes_out by host, dest_ip
      | where total_bytes_out > 100000000 ]
| table host, user, first_seen, last_seen, commands, dest_ip, total_bytes_out

Microsoft KQL

let Window = 24h;
let Staging = DeviceProcessEvents
| where Timestamp > ago(Window)
| where (FileName == "tar" and ProcessCommandLine has "-czf")
    or (FileName == "openssl" and ProcessCommandLine has_all ("enc", "-aes-256-cbc"))
| summarize StageEvents=count(), Commands=make_set(ProcessCommandLine), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName
| where StageEvents >= 2 and datetime_diff('minute', LastSeen, FirstSeen) < 5;
DeviceNetworkEvents
| where Timestamp > ago(Window)
| where RemotePort in (443, 80) and SentBytes > 50000000
| summarize TotalSent=sum(SentBytes) by DeviceName, RemoteIP
| where TotalSent > 100000000
| join kind=inner (Staging) on DeviceName
| project DeviceName, AccountName, Commands, FirstSeen, LastSeen, RemoteIP, TotalSent

Sigma

title: Mass File Staging, Archive Creation & Symmetric Encryption Utility Chained on the Same Host (Pre-Encryption Data Theft / Ransomware Impact)
id: 1a2b3c4d-5e6f-4789-9abc-def012345603
status: experimental
description: Detects the tar-archive-then-openssl-encrypt sequence used to stage sensitive data for exfiltration and encrypt it for impact, matching the pre-encryption data-theft and double-extortion pattern documented in Proofpoint's 2026 AI-Era Ransomware Report (65-83% of incidents involved data theft before/alongside encryption).
references:
    - https://www.proofpoint.com/us/resources/threat-reports/ai-era-ransomware-report
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-26
tags:
    - attack.collection
    - attack.exfiltration
    - attack.impact
    - attack.t1005
    - attack.t1567
    - attack.t1486
    - attack.t1657
logsource:
    product: linux
    category: process_creation
    definition: 'Requires auditd/execve process auditing (auid, comm, exe fields)'
detection:
    staging:
        Image|endswith: '/tar'
        CommandLine|contains: '-czf'
    encryption:
        Image|endswith: '/openssl'
        CommandLine|contains|all:
            - 'enc'
            - '-aes-256-cbc'
    condition: staging or encryption
    timeframe: 'both selections observed from the same parent process/session within 5 minutes'
falsepositives:
    - Legitimate backup/archival jobs using tar+openssl (correlate against a scheduled-backup allowlist by parent process and schedule window)
level: high

Known false positives:

• Legitimate backup/archival jobs using tar+openssl
• Scheduled DR replication transferring large encrypted archives to an approved offsite target

Tuning notes: Correlate the destination IP/domain against an approved-backup-destination allowlist before alerting; lower the byte thresholds for smaller environments where legitimate transfers rarely exceed a few MB.

• 🔒 AI-Authored Spearphishing Delivery Correlated with Organizational Reconnaissance (Ransomware Precursor) · unlock with TL Creds
• 🔒 Renamed System-Binary Execution Correlated with Post-Phishing Valid-Account Logon (Masquerading + Credential Reuse) · unlock with TL Creds
• 🔒 Mass Data Staging, Archive-and-Encrypt Sequence, and Outbound Transfer (Pre-Encryption Data Theft / Double-Extortion Impact) · unlock with TL Creds
• 🔒 AI-Authored Spearphishing Lure Delivery (Multi-Vector BEC/Credential-Harvest Precursor) · unlock with TL Creds
• 🔒 Renamed System-Looking Binary Executed Shortly After Phishing-Linked Account Logon (Masquerading + Valid-Account Reuse) · unlock with TL Creds
• 🔒 Mass File Staging, Archive Creation & Symmetric Encryption Utility Chained on the Same Host (Pre-Encryption Data Theft / Ransomware Impact) · unlock with TL Creds
• 🔒 AI-Authored Spearphishing Delivery Correlated with Organizational Reconnaissance (Ransomware Precursor) · unlock with TL Creds
• 🔒 Renamed System-Binary Execution Correlated with Post-Phishing Valid-Account Logon (Masquerading + Credential Reuse) · unlock with TL Creds

Indicators of compromise for Proofpoint AI-era ransomware survey

As of 2026-07-25, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1702.

How Proofpoint AI-era ransomware survey works

No specific ransomware variant, campaign, or threat actor is named; the report documents a measurable, evidence-backed shift in initial-access lure quality rather than a single technical incident.

On July 22, 2026, Proofpoint published its 2026 AI-Era Ransomware Report, a global survey of 953 cybersecurity professionals spanning 12 countries (United States, United Kingdom, France, Germany, Italy, Spain, United Arab Emirates, Australia, Japan, Singapore, India, and Brazil) and 20 industries, fielded March-April 2026. The headline finding is that 65% of organizations that suffered a ransomware attack said artificial intelligence made the attack more effective (28% said significantly more effective, 37% somewhat more effective, versus roughly 9-11% who saw no evidence of AI involvement).

The report frames this not as a new ransomware variant or a single incident, but as a measurable quality shift in the initial-access lure: attackers are using AI to generate more convincing phishing emails, write more targeted impersonation and Business Email Compromise (BEC) messages, and conduct faster reconnaissance of an organization's structure and internal communication patterns before ever sending a lure. Proofpoint CSO Ryan Kalember summarized it as: "AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to ransomware."

Quantitatively, respondents identified malicious links (47% globally), malicious attachments (46%), credential harvesting (36%), and Business Email Compromise (35%) as the leading initial-access vectors preceding ransomware deployment. Regional breakouts show significant variance and, in some markets, additional vectors: the UAE reported the highest rates of QR-code phishing ("quishing," 55%) and telephone-oriented attack delivery/vishing (45%), alongside the highest AI-effectiveness rate globally (83%). Roughly 38-40% of global respondents said the lure appeared legitimate enough that employees did not suspect it, and about a third (33%) said email security controls failed to detect the attack outright, with another quarter (25%) citing misconfiguration or control gaps.

The report also documents the broader evolution of ransomware from a pure encryption event into a sustained, multi-channel extortion campaign: 65-67% of global respondents (60% in the US, 66% in the UK, 83% in the UAE) confirmed data was stolen before or alongside encryption, giving attackers additional leverage beyond the decryption key. 54% of affected organizations paid a ransom (93% in the US, 58% in the UK, 81% in the UAE), and critically, 37% of those who paid (22% UK, 47% UAE) later faced a second extortion demand — evidence that payment does not reliably end the incident. Proofpoint India Country Manager Bikramdeep Singh framed the underlying dynamic bluntly: ransomware "succeeds by exploiting people's trust, not just systems."

No CVE, malware family, C2 infrastructure, or named threat actor/group is cited in this report — it is a cross-industry trend/perception survey, not an incident writeup. It is included in this platform as a sourced, quantified signal that AI is measurably raising the success rate of the phishing/BEC/credential-theft lures that most ransomware intrusions still begin with, which should inform email-security tuning, awareness training, and pre-ransomware detection (data-theft, credential misuse) priorities.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice

Execution

T1204.001 Malicious Link; T1204.002 Malicious File

Impact

T1486 Data Encrypted for Impact; T1657 Financial Theft

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1585.001 Social Media Accounts; T1588.002 Tool

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information

reconnaissance

T1598 Phishing for Information; T1598.003 Spearphishing Link

stealth

T1684.001 Impersonation

Remediation for Proofpoint AI-era ransomware survey

Immediate actions

• Reinforce phishing/vishing/quishing reporting workflows and update security-awareness training to include AI-quality lure examples, since the report finds ~38-40% of employees interacted with or did not suspect the lure
• Enforce MFA and conditional access on all remote-access and email-adjacent services to blunt outcomes when the 36% credential-harvesting vector succeeds
• Re-tune email security controls (SPF/DKIM/DMARC enforcement, attachment/link sandboxing, URL rewriting) to close the ~33% full-bypass and ~25% misconfiguration gaps the report identifies
• Establish a verified out-of-band callback procedure for high-risk requests (wire transfers, credential resets, executive/BEC-style asks) to counter AI-voice and impersonation lures

Longer-term hardening

• Adopt AI-aware email/collaboration security tooling capable of flagging LLM-generated phishing content, synthetic voice, and deepfake-style impersonation
• Build out pre-ransomware data-theft detection (DLP, UEBA, unusual mass-access/egress alerting) given the report's finding that 65-83% of incidents included data theft before or alongside encryption
• Adopt a documented ransom-payment governance policy that accounts for the report's 37% second-extortion-demand rate — payment does not guarantee resolution
• Run recurring AI-generated phishing/vishing/quishing simulation exercises calibrated to the highest-ranked vectors in this report (malicious link, BEC, credential harvesting, and — regionally — QR-code phishing and vishing)

Timeline of Proofpoint AI-era ransomware survey

• 2026-03-01 locked-ioc-20 begins fielding its survey of 953 cybersecurity professionals across 12 countries and 20 industries for the 2026 AI-Era Ransomware Report.
• 2026-04-30 locked-ioc-20 completes the fielding window for the 2026 AI-Era Ransomware Report survey (March-April 2026).
• 2026-07-22 locked-ioc-20 issues US/UK press releases with headline findings, including the 65% AI-effectiveness figure and locked-ioc-19's quote.
• 2026-07-22 locked-ioc-20 publishes the 2026 AI-Era Ransomware Report, finding 65% of ransomware-affected organizations say AI made the attack more effective.
• 2026-07-23 Coverage of locked-ioc-20's UAE-specific findings publishes: 83% of affected UAE organizations report AI increased attack effectiveness (the highest of any surveyed market), alongside an 81% ransom-payment rate and elevated QR-code phishing (55%) and vishing (45%) vectors.
• 2026-07-23 locked-ioc-20 publishes India-specific findings: 62% of Indian ransomware-affected organizations report AI increased attack effectiveness, with user interaction cited as a top bypass factor (49%); India Country Manager locked-ioc-17 is quoted on trust exploitation.
• 2026-07-23 Infosecurity Magazine, VMblog, CRN Asia, Security Matters Magazine, and other outlets report on the locked-ioc-20 findings, including the 47%/46%/36%/35% initial-access vector breakdown.
• 2026-07-25 TL-Intel-Harness ingests the report via the Infosecurity Magazine RSS feed and opens threat record TL-2026-1702 for tracking.

Sources cited for Proofpoint AI-era ransomware survey

• Proofpoint Research Finds 65% of Organisations Affected by Ransomware Say AI Made Attacks More Effective Proofpoint · Vendor report · 2026-07-22
• 2026 AI-Era Ransomware Report Proofpoint · Vendor report · 2026-07-22
• Proofpoint Research Finds 62% of Indian Organizations Affected by Ransomware Say AI Made Attacks More Effective Proofpoint · Vendor report · 2026-07-23
• Proofpoint: AI-Powered Ransomware Threatens India: 62% of Hit Firms Report Higher Attack Impact blog.rankiteo.com · Blog · 2026-07-23
• AI Boosts Ransomware Effectiveness, Say Victims infosecurity-magazine.com · News · 2026-07-23
• Ransomware succeeds by exploiting people's trust, not just systems: Proofpoint crnasia.com · News · 2026-07-23
• AI making ransomware attacks "significantly more successful" states Proofpoint securitymattersmagazine.com · News · 2026-07-23
• AI Is Driving More Convincing Ransomware Attacks in the UAE securitymea.com · News · 2026-07-23
• Proofpoint Says Paying Ransomware Gangs Can Invite A Second Demand techbooky.com · News · 2026-07-23
• Proofpoint Research Finds 65% of Organizations Affected by Ransomware Say AI Made Attacks More Effective vmblog.com · News · 2026-07-22
• Proofpoint Research Finds 62% of Indian Organizations Affected by Ransomware Say AI Made Attacks More Effective cioandleader.com · News · 2026-07-23

Threats related to Proofpoint AI-era ransomware survey

• Malwarebytes: Scammers Increasingly Match Scam Type to Platform, Targeting Victims by Channel and Time
• Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusion
• Malwarebytes Subscription Renewal Scam — Fake-Invoice / Refund-Bait Callback Phishing Campaign ("Account Maintenance Update")
• CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups and Outlook Calendar Invites for Persistent Lures and EvilTokens Device-Code Session Theft
• Balonx Sistema PhaaS Campaign — AI Voice Calls and Fake Banking Pages Targeting Mexican Financial Institutions

Related coverage of this activity

• SafePal order-tracking IDOR
• ASCII smuggling finance phishing
• Trezor ShipMonk customer data breach
• Russian clone-site prepayment fraud