Cybercrime becomes automated AI-enabled system, ransomware surges 389%

Cybercrime is rapidly evolving into a structured, automated, and interconnected ecosystem ¹. Fortinet's 2026 Global Threat Landscape Report, based on FortiGuard Labs telemetry from 2025, reveals that cyberattacks are no longer isolated campaigns but coordinated operations within a broader criminal infrastructure ¹.

Attackers leverage automation, AI-enabled tools, access brokers, and malware services to accelerate the attack lifecycle ¹. Time-to-exploit is shrinking dramatically. FortiGuard Labs observed that critical vulnerabilities can now be exploited within 24 to 48 hours—down from an average of 4.76 days ¹. In some cases, exploitation attempts began within hours of public vulnerability disclosure ¹.

Ransomware activity surged significantly ¹. FortiRecon adversary intelligence identified 7,831 confirmed ransomware victims globally, compared with around 1,600 in the previous year—a 389% year-on-year increase ¹. Manufacturing, business services, and retail faced the heaviest targeting, with the United States, Canada, and Germany reporting the highest victim concentrations ¹.

Identity has emerged as a critical cloud vulnerability ¹. FortiCNAPP intelligence found that most confirmed cloud incidents in 2025 originated from stolen, exposed, or misused credentials rather than direct infrastructure exploitation ¹. Hospitals, physician clinics, and retail operations were particularly vulnerable, owing to large identity populations, federated access models, and complex cloud integrations ¹.

Stolen datasets now command higher value than leaked credentials ¹. AI-enabled offensive tools are lowering the skill barrier for attackers ¹, allowing less sophisticated threat actors to execute increasingly complex operations.