Threat Intelligence

AI Agents Are Now Running Ransomware Attacks End to End

SOCRadar · 15 Sept 2026

Key Takeaway SMBs should assume ransomware attacks may increasingly involve AI agents that adapt in real time, making strong basics like patching, credential hygiene and network segmentation more important than ever.

Ransomware has traditionally required a human somewhere in the loop, whether an affiliate manually moving through a network or a person scripting the malware's actions. SOCRadar's latest research describes a shift it calls agentic ransomware, where an autonomous AI agent makes the operational decisions itself, from initial access through to the extortion demand, without a person approving each step.

The report points to an operation named JADEPUFFER, documented by security researchers in July 2026, as the first confirmed case of an AI agent running a complete extortion campaign end to end. Unlike commodity ransomware such as WannaCry, which follows a fixed pre-written script, agentic ransomware works toward a goal and lets the model decide its own path: what to exploit, which credentials to try, when to move laterally, and when to encrypt or destroy data, adapting when a step fails. SOCRadar notes it had already seen an early version of this trend in its own investigation into FortiBleed, where an affiliate used a 14-agent AI framework to research vulnerabilities and build attack playbooks that were then handed to human operators.

This marks a change from earlier automated ransomware, since the decision-making itself is now delegated to AI rather than just the execution. SOCRadar frames this as part of a broader progression in ransomware operating models, from fully human-operated through AI-assisted to fully agentic attacks.

Summarised by CISO AI from SOCRadar. We link back to every original so you can read it yourself.