Cyber Centre warns ransomware gangs are using AI and widening their targets
The Canadian Centre for Cyber Security said Jan. 28 that ransomware incidents known to it rose from 2021 to 2024 and that criminals are now using artificial intelligence to find weaknesses, write malware and pressure victims.
The agency's Ransomware Threat Outlook 2025-2027 says actors targeting Canadians are almost certainly opportunistic and financially motivated, which means any organization can be hit. For small and medium businesses, it warns, downtime, supply chain delays and recovery costs could determine whether the business remains viable.
What the report says
The Cyber Centre said attackers have started using AI to spot vulnerabilities, develop malware, generate deepfake images and automate ransom negotiations, and that AI helps criminals overcome technical barriers and a lack of resources, The Canadian Press reported. Data theft as an extortion tool is trending upward, though most groups will likely keep encrypting systems too. One group targeting Canadian victims launched denial-of-service attacks during negotiations to add pressure.
Critical infrastructure and large companies remain attractive because they may pay to avoid disruption, but the report says "no organization is immune." Law360 Canada noted the report's finding that attackers are expanding beyond large organizations.
"Many small businesses have a single IT person, and they're required to do cybersecurity as well," said Rajiv Gupta, head of the Cyber Centre.
The managed service provider risk
The outlook flags managed service providers as attractive targets because one breach can reach many clients. That is relevant to small firms, many of which outsource IT entirely. The report cites survey data showing an 11 per cent drop in organizations employing their own cybersecurity staff, largely because they rely on consultants and providers instead.
What to do
- Patch promptly and turn on automatic updates.
- Use multi-factor authentication for every remote and cloud login.
- Keep routine, tested backups, including one copy that is offline.
- Train staff to recognize phishing and spoofed websites.
- Ask your IT provider how it secures its own access to your systems.
- Keep your cyber insurance details private; the report says attackers can use them to set a ransom.
- Report incidents to local police, the Canadian Anti-Fraud Centre and the Cyber Centre. The agency offers a free Ransomware Playbook and baseline controls for small and medium organizations.
