Ransomware on the rise while security focuses on AI agents: traditional groups take advantage of the lapse

While the security community is preoccupied with AI agents as a new attack vector, traditional ransomware groups are quietly stepping up their operations. *The Register* documents the correlation.

(1) What: A dangerous halo effect

The Register documents a trend that many security practitioners had sensed without clearly articulating: the growing focus on autonomous AI agents as an attack vector has absorbed an increasing share of security teams' attention, conferences, and monitoring budgets—while major ransomware groups continued their operations, or even intensified them.

Data from July-August 2026 shows a surge in ransomware attacks correlating with the period of intense focus on offensive AI agents (incidents involving Anthropic, DeepSeek-Hermes, etc.). The gangs aren’t watching sandboxes escape—they’re exploiting the fact that others are.

(2) Who is impacted

This phenomenon is not new in the threat landscape: every time a new attack vector captures media and academic attention, traditional ransomware actors operate with less scrutiny. The distraction acts as a risk multiplier.

Sectors historically targeted (healthcare, local governments, critical industries) remain on the front lines. The most active groups right now are affiliates of former LockBit members and new opportunistic entrants.

(3) What to do

This isn’t an argument against monitoring autonomous AI agents—the two threats are real and complementary. It’s an argument for not robbing Peter to pay Paul when it comes to allocating monitoring resources and security coverage.

What to do now:

• Maintain ransomware coverage in your monitoring—don’t reduce it in favor of AI agent monitoring.
• Test your backups and verify their network isolation (modern ransomware targets backups first).
• Check exposed RDP and VPN access: they remain the #1 entry vector in 2026 ransomware incidents.