Report on AI-driven ransomware gave misleading picture

"MIT Sloan School of Management recently retracted a study that claimed that the majority of ransomware attacks today are driven by artificial intelligence. This was reported by The Register. The report (note: Wayback Machine) attracted attention by stating that around 80% of attacks in 2024 would use AI techniques. After strong criticism from security researchers, MIT decided to remove the document from its website and announced that a revised version is in the works."

"However, the publication was met with skepticism within the security community. Several experts pointed out that the authors were unable to substantiate their findings. Critics noted that the report even referred to outdated malware projects that had not been active for years. The methodology used was also questioned by specialists, as it was unclear how the researchers had determined that AI was actually involved in the attacks."

"One of the most prominent critics was security researcher Kevin Beaumont, who argued on social media that the report was factually incorrect and resembled marketing rather than scientific work. Other experts agreed, emphasizing that such publications undermine confidence in cybersecurity research. Even Google's AI Overview, which automatically checks information, indicated that there is no evidence for the percentage mentioned."

MIT Sloan School of Management removed a working paper that claimed about 80% of 2024 ransomware attacks used AI techniques and announced a revised version. The research stemmed from collaboration with Safe Security and analyzed thousands of incidents to conclude AI's rising role in cybercrime. Security experts criticized the findings for lacking substantiation, citing references to outdated malware and unclear methodology for attributing AI use. Prominent critics called the work factually incorrect and marketing-like. Google's AI Overview found no evidence supporting the claimed percentage. MIT retitled the accompanying blog post to emphasize caution and defense.

Read at Techzine Global