AI-Driven Cybercrime Causes 389% Surge in Ransomware Victims
Fortinet's 2026 Global Threat Landscape Report documented a 389% year-over-year increase in ransomware victims in 2025, attributing the surge to cybercriminals increasingly using agentic AI to execute sophisticated attacks and compress attack timelines. The report found AI tools are being deployed across reconnaissance, social engineering, and credential theft, though most successful breaches still result from human error and system defects rather than direct AI failures.
What happened
The Fortinet 2026 Global Threat Landscape Report, released on April 30, 2026, found a 389% year-over-year increase in ransomware victims in 2025.
The report attributed the surge to malicious actors increasingly leveraging agentic AI to execute more sophisticated attacks and compress attack life cycles with shadow agents.
Cybercriminals adopted AI tools in reconnaissance, social engineering, and malware development, and weaponized AI after gaining network access, as seen with the QUIETVAULT tool that uses AI to explore systems and collect credentials and tokens.
Reported impact
The 389% increase in ransomware victims represents a substantial rise in cybercrime targeting, affecting organizations across multiple sectors including high-tech and financial industries.
Index analysis
Fortinet's FortiGuard Labs telemetry showed cybercrime now operates as a system with malicious actors functioning across an end-to-end attack life cycle, with automation reducing handoff times from over 8 hours in 2022 to an average of 22 seconds by 2025.
AI remained primarily a supplementary tool in 2025 attacks, with most successful breaches still stemming from basic human error and system defects rather than direct AI-caused compromises.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.