According to FortiGuard Labs’ 2026 Global Threat Landscape Report, the number of ransomware victims worldwide has increased by 389 percent. AI-driven attack methods, malware, and stolen datasets are making organizations more vulnerable than ever.
The latest report from FortiGuard Labs paints a clear picture of cyber threats in 2025. Cybercriminals are increasingly using autonomous AI agents, which speeds up attacks. Shadow agents perform unseen actions within networks, making it harder for organizations to detect intruders in time.
Researchers emphasize that classic, isolated attack campaigns have been replaced by a systematic and automated attack lifecycle. By deploying AI, cybercriminals can accelerate their workflow and refine their techniques, resulting in a significant increase in the number of successful attacks.
Speed and scale
The time-to-exploit for critical vulnerabilities dropped to an average of 24 to 48 hours in 2025, compared to 4.76 days in previous years. This means criminals strike almost immediately as soon as a new leak becomes known. For example, the React2Shell vulnerability was attacked en masse within hours of disclosure.
Globally, 7,831 organizations were hit by ransomware, compared to approximately 1,600 the previous year. The manufacturing, professional services, and retail sectors were targeted most frequently. The impact was particularly high in the United States, Canada, and Germany. Belgium and the Netherlands have also recently faced various cyberattacks: consider Bol.com, Basic-Fit and Booking, AZ Monica, and a school in Berchem.
Furthermore, it appears that 35 percent of European organizations cannot even determine whether they have been the target of an AI-driven cyberattack, according to research by Isaca.
New weapons
According to researchers, AI-supported attack tools such as WormGPT, FraudGPT, and HexStrike AI are easily available on the dark web. These tools automate reconnaissance and generate attack paths, meaning cybercriminals require less technical knowledge. Smarter techniques ensure that fewer attempts are needed to crack a password.
The popularity of stolen datasets continues to grow. According to FortiGuard Labs, stealer logs—which combine identity data and contextual information—now account for 67.12 percent of traded data on the dark web. Credential stealer malware such as RedLine, Lumma, and Vidar remains a major problem, with hundreds of thousands of infections worldwide.