New data from Cohesity suggests the geography of ransomware is changing. According to IT Pro's reporting, Europe has become a primary target as the number of ransomware attacks in the US declines. Two groups alone account for roughly a third of ransomware attacks in the UK. And the headline's central argument is that the biggest shift is not just sophistication: AI is making AI ransomware attacks UK Europe campaigns easier to scale and harder to predict.
The source material is brief, so this post sticks to what has been reported and focuses on what it means in practice.
Why ransomware is shifting toward the UK and Europe
The key finding from Cohesity's data is a change in direction. As attacks in the US decline, pressure is moving toward European targets, with the UK prominent in the figures.
The reporting does not lay out every reason for the shift, and it would be a mistake to guess. What the data does tell us is that ransomware activity is not fixed. Criminal groups go where they expect results, and a drop in one region does not mean the overall threat is shrinking. It can simply mean the threat is relocating.
For readers in the UK and across Europe, the practical takeaway is that you should not assume your organisation is too small, too remote or too unremarkable to be considered. When a region moves up the target list, the whole ecosystem of businesses, charities, schools and individuals in it feels the pressure.
Two groups behind a third of UK attacks
The headline figure is that two groups account for around a third of ransomware attacks in the UK. That is a notable concentration. It suggests a large share of the UK's ransomware problem comes from a small number of operators rather than a scattered crowd of unrelated criminals.
There are two ways to read that:
- The bad news: a few well-organised groups can cause a disproportionate amount of harm, and they have clearly found methods that work against UK victims.
- The useful news: concentrated threats tend to be easier to study. When a small number of groups drive many incidents, defenders can focus on the techniques those groups rely on, and that knowledge often filters down into practical advice.
The report as summarised does not name the groups or detail their methods, so we won't speculate. If you run a business, it is worth checking whether your security provider or national cyber agency publishes guidance on the groups most active in your region.
How AI lowers the barrier for ransomware gangs
The quote in the article's headline gets to the heart of it: the change is not simply that attacks are becoming more sophisticated, but that AI makes them easier to scale and harder to predict.
That distinction matters. Scale means a single group can attempt more attacks with less effort and cost. Unpredictability means the old tells, such as clumsy phrasing, obvious templates or repetitive patterns, may be less reliable guides to what is malicious.
This lines up with earlier warnings from the UK's National Cyber Security Centre. Coverage of its January 2024 assessment noted that AI is expected to make cyber attacks against the UK more impactful by enabling faster, more effective data analysis. Other reporting highlighted that AI can remove language barriers, which can make approaches and ransom negotiations easier for criminals working across borders. That is especially relevant as attention turns toward a multilingual region like Europe.
The point is not that AI has produced unstoppable malware. It is that it can lower the skill and time needed to run a campaign, which widens the pool of potential victims and makes any single attack harder to anticipate.
What this means for you
If you are an individual, a freelancer or a small business owner, the story can feel remote, as though it concerns large enterprises and criminal gangs. But scalable, cheaper attacks are exactly the kind that reach smaller targets, because automation makes it worthwhile to cast a wide net.
The good news is that the defences that matter most are not exotic. When attacks become harder to predict, the answer is to rely less on spotting a suspicious detail and more on layers that still protect you if someone slips up.
What individuals and small businesses can do now
- Keep offline or immutable backups. Ransomware works by making your data unavailable. A backup that attackers cannot reach or alter, because it is disconnected or write-protected, takes away much of their leverage. Test restoring from it, not just creating it.
- Treat every unexpected message with caution. If AI helps polish phishing messages, grammar and tone are weaker signals than before. Verify requests through a separate channel, especially anything involving payments, passwords or urgent deadlines, and be wary of unexpected links and attachments.
- Turn on multi-factor authentication. Enable it on email, cloud storage, banking and any remote access tools. If a password is stolen, a second factor can stop an intruder from getting in.
- Keep software updated. Apply updates to operating systems, apps and devices promptly, since attackers often rely on known weaknesses that have already been fixed.
- Plan before you need it. Know who you would call, what you would disconnect and how you would communicate if systems went down. Even a one-page plan helps.
The bottom line
The Cohesity data points to a clear trend: ransomware pressure is moving toward the UK and Europe as US attacks decline, a small number of groups account for a large share of UK incidents, and AI is helping attackers work faster and less predictably. You cannot control where criminals choose to aim, but you can control whether an attack on you succeeds. Review your backups this week, switch on multi-factor authentication where it is missing, and talk to anyone who shares your accounts or devices about spotting phishing. These are small steps, but they remain the most reliable protection against AI ransomware attacks in the UK and Europe.
