Cyber Centre says AI is making ransomware cheaper and faster for criminals

The Canadian Centre for Cyber Security released its Ransomware Threat Outlook 2025 to 2027 on Jan. 28, assessing that ransomware will remain a significant threat to Canada over the next two years and that artificial intelligence is making attacks cheaper, faster and harder to detect.

The outlook is the Cyber Centre's main forward-looking judgment on the crime that most often disrupts Canadian hospitals, municipalities and businesses. It does not predict a dramatic new kind of attack. Its message is that the existing business model is getting more efficient, and that basic defences still work.

What the outlook says

According to the CSE news release, ransomware actors are opportunistic and motivated by profit, and every Canadian organization is exposed. The number of ransomware incidents known to the Cyber Centre rose from 2021 to 2024, the report says, without publishing totals in the coverage.

The Canadian Press reported that the outlook describes criminals using AI to spot vulnerabilities, write malware, generate deepfake images and automate ransom negotiations. AI helps less-skilled actors get past technical barriers and staff shortages.

Three trends stand out:

• Data theft over encryption. Most groups will likely keep encrypting systems, but stealing data to threaten publication is trending upward.
• Multi-extortion. Groups increasingly pressure victims by threatening their partners and clients or launching denial-of-service attacks during negotiations.
• High-value targets. Critical infrastructure, including energy and water facilities, and large corporations remain attractive because downtime is costly.

Early warnings are paying off

The release highlights the Cyber Centre's pre-ransomware notification program, which warns organizations when it sees signs of an intrusion that typically precedes encryption. It issued 336 such notifications to more than 300 Canadian organizations in 2024, which the agency estimates saved up to $18 million.

"Ransomware is big business," CSE chief Caroline Xavier said in the release. Rajiv Gupta, head of the Cyber Centre, said education on the threat "has never been more important."

Why the money matters

The Canadian Press noted that payments are often demanded in cryptocurrency, which is one reason police and allies have targeted the services that launder it. The outlook frames ransomware as an economic enterprise: groups calculate what a victim can pay, then add pressure until it does. Gupta described ransomware as among the most disruptive, costly and persistent challenges facing Canadian organizations of every size, and the report states plainly that "no organization is immune."

That framing explains why the report spends as much time on resilience as on attackers. It argues that cybersecurity practices are not an optional extension of running a business, and it points organizations to free Cyber Centre resources, including the Assemblyline malware analysis tool, for continuous network monitoring.

Reading between the lines

For defenders, the practical point is that the outlook's recommended controls are the same basics the Cyber Centre has promoted for years: patching, multi-factor authentication and phishing awareness. The report's judgment is that these remain effective even as attackers add AI to their toolkits.

The report also leans on cooperation. It says countering ransomware requires law enforcement, government, private organizations and the public working together, a theme reflected in Canadian participation in operations such as Operation Endgame.

What the public coverage does not provide is a count of incidents, a breakdown of how many Canadian organizations paid ransoms, or how much was lost.

What to do

• Patch internet-facing systems quickly, especially VPNs, firewalls and remote access gateways.
• Enforce multi-factor authentication and keep offline, tested backups.
• Train staff to spot phishing, including AI-generated lures and deepfake voice or video requests.
• Subscribe to the Cyber Centre's notification services and report incidents to the Cyber Centre and police.