The New Ransomware Economics | Edwin Bowers & CrowdStrike on Modern Cyber Extortion

Ransomware has matured into a sophisticated criminal business model. Attackers now focus on multi-extortion tactics, stealing data, exploiting identity, and targeting operations to maximize pressure on victims rather than simply encrypting systems. High-profile attacks in recent years all follow this pattern.

AI is lowering the barrier to entry for cybercriminals by enabling highly convincing social engineering, automated reconnaissance, and accelerated phishing campaigns. This elevates less sophisticated threat actors while also amplifying the most advanced ones, compressing the time between initial access and impact.

AI tools like generative AI make it easier for lower-skilled attackers to craft convincing attacks with minimal effort. Nation state actors are also misusing these tools in more advanced ways, including prompt injection to bypass guardrails in AI models, raising the overall threat level across the board.

Individual signals like failed logins or unusual VPN access may look insignificant in isolation. When security telemetry is fragmented across separate tools, these indicators never get correlated, and suspicious activity goes undetected. Centralizing logs and controls into a single view is essential for catching threats early.

Effective detection involves correlating signals across identity, network, and infrastructure logs simultaneously. For example, combining multiple failed logins in Entra ID with unusual VPN access and abnormal VM activity can surface a suspicious event that no single alert would have flagged on its own.