AI Industrializes Cybercrime, Ransomware Surges 389%: Fortinet

AI is driving the industrialization of cybercrime, leading to a sharp increase in ransomware attacks, according to Fortinet’s 2026 Global Threat Landscape Report. In a new study, the company emphasizes that speed, automation, and identity exploitation now define enterprise risk, requiring a transition toward machine-speed defensive operations. 

Fortinet’s 2026 Global Threat Landscape Report reveals that cybercrime is turning to an integrated industrial system where AI and automation have increased the number of victims by 389% year-over-year. Mexico recorded 58.1 billion cyberattack attempts in 2025, with 30 billion active scans, explains the company.

"At the time that cybercrimes continue to use AI exponentially to drive their tactics, cyber defenders must evolve cybersecurity operations toward an industrialized defense and adopt AI-driven tools that respond at the same speed as modern threats," says Derek Manky, Vice President of Global Threat Intelligence, Fortinet. The research, derived from telemetry collected across millions of global sensors, indicates that cybercrime has entered into a continuous production cycle where exposure is harvested, cataloged, and operationalized at scale. 

During 2025, FortiGuard Labs recorded significant reconnaissance activity across all regions, including 260.13 billion scanning events in the Asia-Pacific region, 168.36 billion in the European Union, Middle East, and Africa, 156.68 billion in North America, and 54.65 billion in Latin America. 

Within Mexico, threat activity remains high, contributing to the broader Latin American trend of sustained growth in criminal infrastructure by recording 58.1 billion cyberattacks attempts and 30 billion scans during 2025. 

Adversaries now operate through a mature supply chain that feeds continuous intrusion activity across the attack lifecycle. The company analyzed this persistent pressure through the FortiGuard SecOps Kill Chain, a framework that identifies six stages of the threat lifecycle: exposure, weaponization, exploitation, post-exploitation, impact, and decisions. The 2026 report highlights several critical shifts in the adversary operating model, primarily driven by speed and the commoditization of exploits. 

The Collapse of Exploitation Windows

Time-to-exploit (TTE) has compressed significantly because of automation. The window between public vulnerability disclosure and the first observed exploitation attempt now ranges from 24 to 48 hours. In several critical outbreaks, such as those involving Fortra GoAnywhere MFT and Apache Tomcat, exploitation activity appeared on the same day as disclosure. This speed indicates that attackers no longer evaluate new vulnerabilities over time; they treat them as immediate inputs for automated workflows. 

The study shows that 121.99 billion exploitation attempts occurred in 2025, representing a 25.49% increase compared to the previous year. This volume is sustained by the high availability of exploit code. Of the 635 vulnerabilities observed under active exploitation, 53.86% had publicly available proof-of-concept code and 31.18% had fully functional weaponized code. 

Identity as Industrial Raw Material

Identity data has become the primary fuel for industrialized intrusions. FortiRecon intelligence recorded 4.62 billion stealer logs traded or shared on the darknet, a 79.07% increase compared to 2024. These logs bundle identity material with contextual browser artifacts, enabling immediate replay and faster conversion than traditional brute-force methods. 

The production of these logs is dominated by specific malware families:

• RedLine: responsible for 911,968 infections. 
• Lumma: responsible for 499,784 infections. 
• Vidar: responsible for 236,778 infections. 

This identity exposure provides attackers with over 35 million records for SSO portals, 6.6 million for GitHub, and 6 million for webmail. Consequently, valid credentials serve as the exploit in modern attacks, allowing adversaries to bypass traditional security controls. 

Systematic Ransomware Production and Cloud Intrusion 

Ransomware now functions as a high-throughput economic engine, reports the study. The 7,831 confirmed victims recorded in 2025 reflect a production model that targets organizations based on downtime intolerance and operational dependency. 

The manufacturing sector experienced the highest impact with 1,284 victims, followed by business services with 824 victims and retail with 682 victims. Geographically, the United States recorded 3,381 victims, while Canada and Germany followed with 374 and 291 victims, respectively. 

The ransomware ecosystem remains fragmented yet highly productive, with top groups like Qilin and Akira achieving scale through efficient execution. The availability of AI-enabled kits further reduces the skill requirements for these operations. 

In cloud environments, identity compromise remains the dominant intrusion vector. FortiCNAPP intelligence confirms that most cloud incidents in 2025 originated from stolen or misused credentials rather than infrastructure exploits. Once attackers gain access, they use discovery-heavy API bursts to map environments and identify privilege escalation paths. 

Sector analysis indicates that hospitals and department stores show the highest concentration of identity compromise because of large user populations and complex cloud integrations. In these environments, misconfigurations act as accelerators, shortening the path from initial access to monetization through resource hijacking or cryptomining. 

The Role of AI in Offensive Tooling

AI has become a force multiplier for offensive operations, reads the report. New tools advertised on darknet forums, such as HexStrike AI and APEX AI, automate reconnaissance and attack-path generation. Brute Force AI integrates large language models to analyze login forms and execute multi-threaded attacks with human-like behavior patterns. While these tools do not create new vulnerabilities, they compress the time required to validate and activate existing exposure. 

The industrialization of threats requires organizations to prioritize defensive velocity. Security advantage is no longer defined by tool volume but by the speed of identification and containment. FortiGuard Labs recommends that enterprises adopt continuous threat exposure management to prioritize remediation based on real-world exploitation evidence. 

Because command-and-control infrastructure operates persistently, with 7.10 billion botnet detections recorded in 2025, compromise must be treated as a steady-state operating condition.

Fortinet explains that leaders should shift key performance indicators from alert volume to time-to-containment and time-to-revocation of compromised credentials. Stopping the lateral spread of an intrusion after entry is now the primary factor in determining the repercussions of a breach.