--- title: "Acronis Cyberthreats Report H2 2025: Cybercriminals are now scaling attacks with AI" description: Cybercriminals are spending less time using AI to develop new kinds of cyberattacks. Unfortunately, that’s not good news. According to the Acronis Cyberthreats Report H2 2025, cybercriminals are focusing on using AI to scale and refine the attacks they’ve already developed. As a result, they’re working more efficiently. canonical_url: https://www.acronis.com/en/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Acronis Cyberthreats Report H2 2025: Cybercriminals are now scaling attacks with AI Cybercriminals are spending less time using AI to develop new kinds of cyberattacks. Unfortunately, that’s not good news. According to the Acronis Cyberthreats Report H2 2025, cybercriminals are focusing on using AI to scale and refine the attacks they’ve already developed. As a result, they’re working more efficiently. [Learn more](https://www.acronis.com/en/products/cloud/cyber-protect/extended-detection-and-response/) [![Image 2: Lee Pender](https://staticfiles.acronis.com/images/content/96b4b6d9ceee3c624b79f42543d1d633.png)](https://www.acronis.com/en/blog/authors/lee-pender/ "Lee Pender") [Lee Pender,](https://www.acronis.com/en/blog/authors/lee-pender/)Senior Content Marketing Manager 3 min read Last updated 20 February 2026 Other languages available:[Deutsch](https://www.acronis.com/de/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [Español](https://www.acronis.com/es/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [Français](https://www.acronis.com/fr/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [Italiano](https://www.acronis.com/it/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [日本語](https://www.acronis.com/ja/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [Português](https://www.acronis.com/pt/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) Cybercriminals are spending less time using AI to develop new kinds of cyberattacks. Unfortunately, that’s not good news. According to the Acronis Cyberthreats Report H2 2025, cybercriminals are focusing on using AI to scale and refine the attacks they’ve already developed. As a result, they’re working more efficiently. The [Acronis Cyberthreats Report H2 2025](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) delves into many more cybersecurity trends and goes into much deeper detail on the evolving impact of AI on cyberthreats. [![Image 3: Acronis Cyberthreats Report H2 2025](https://staticfiles.acronis.com/images/content/81c57cd166a62390813370b4601962ec.png) Report Acronis Cyberthreats Report H2 2025 Read now](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) ## Cybercriminals are getting a productivity boost from AI According to the report, 80% of ransomware‑as‑a‑service (RaaS) vendors advertise AI or automation features. Attackers are operationalizing AI for scaling existing attacks as opposed to spending time creating new ones. They’re using AI-based capabilities to amplify proven techniques and tactics, including data extortion reconnaissance, fraud and ransomware negotiations. And, like many office workers, cyberattackers are using AI to save time by taking advantage of autonomous and semi‑autonomous task execution. With AI, attackers can reduce workloads and carry out more attacks in less time. They benefit from the same advantages of AI as managed service providers (MSPs) and other businesses do. ### Examples of AI usage in cyberattacks and scams in 2025: * The GLOBAL GROUP ransomware organization introduced an AI‑driven chatbot to negotiate with victims and extract as large a ransom as possible. * Ransomware gang GTG‑2002 used AI tools to generate scripts, harvest credentials and analyze stolen data. * A Chinese state‑aligned intrusion demonstrated agentic AI behavior by connecting reconnaissance and credential use with minimal human input. * Virtual kidnapping scams increased success rates by using AI‑altered photos and videos as fake “proof of life.” ## Cybersecurity statistics: Where the numbers spiked The second half of 2025 delivered clear cyberattack surges across email, collaboration platforms and ransomware. Email remained the dominant attack vector, while [cyberattacks on collaboration apps](https://www.acronis.com/en/blog/posts/phishing-is-a-teams-sport-your-clients-collaboration-tools-also-need-security/) remained the favored place for precision social engineering and privilege abuse. ### Email threats: * Email-based attacks per organization increased 16% year over year and per user by 20%. * Email attacks surged 36% in H2 2025 vs H1 2025, confirming email as the primary initial access point. * Phishing dominated email threats in H2, accounting for 83% of all email threats, while advanced attacks made up only 1%. ### Attacks on collaboration applications: * Advanced attacks in collaboration applications rose sharply from 12% of all attacks in 2024 to 31% in 2025, a rate more than 30x higher than in email. * Malware represented 54% of attacks and phishing 15%. ### Manufacturing in the crosshairs: * Manufacturing and technology were the most attacked sectors, reflecting operational pressure in complex IT / OT environments. * Supply chain and third‑party compromise affected at least 1,200 victims between January and November 2025. ### More ransomware expansion: * Acronis detected nearly 100 active RaaS providers, with 34 new groups observed in H2 2025 alone. * Ransomware attacks rose 50% year over year through October, driven by ransomware groups Qilin, Sinobi and Akira. ## Statistics MSPs need to know For service providers, vulnerabilities remained a significant issue, and some providers failed to patch systems effectively. The report notes that almost 150 MSPs and telcos fell victim to ransomware in 2025, including 69 MSPs. ### Initial access vectors for MSP compromises: **Phishing**: At 52%, still the top vector. **Unpatched vulnerabilities**: Dominant in MSP and supply chain incidents, this type of attack was the initial access vector in 27% of attacks on MSPs. **Credential abuse**: 13%. **Trusted relationships**: 5%. **Remote Desktop Protocol**: 3%. Nearly 3,000 critical vulnerabilities were disclosed in 2025, highlighting the importance and urgency of patch management. Additionally, 100% of vulnerabilities disclosed in MSP platforms, such as RMMs and PSAs, were **High** or **Critical**, underscoring severe operational risk. ## What MSPs can do to protect themselves AI has altered the threat landscape. To keep pace with cybercriminals who are armed with AI, service providers should continue to follow foundational practices and key controls while adopting new technologies and defensive tactics: * Strengthen backup and recovery through immutable backups integrated with detection telemetry to prevent tampering and enable rapid restoration * Fight AI with AI by deploying AI-powered extended detection and response (XDR) to deflect threats before they can do damage and to correlate behavior across endpoints, identities, email and cloud services. * Enforce strong identity controls by adopting a zero trust policy, enforcing multifactor authentication (MFA) universally and monitoring access anomalies across both human and nonhuman accounts. * Accelerate patch management by deploying AI-enabled, automated risk‑based patching. * Extend controls to Teams and other collaboration apps and train users on real‑time impersonation and approval scams to defend against collaboration platform abuse. * Manage AI risks by implementing AI governance, restricting sensitive data in prompts, and logging and auditing AI‑initiated changes **What to expect in 2026** As 2026 unfolds, a few trends are likely to emerge: * AI will become a target and risk surface, with attackers using prompt injection and agent workflow manipulation; MSPs need to audit and put guardrails on their own AI tools. * Ransomware will evolve to extortion‑first, with data theft and regulatory pressure outweighing encryption as the primary method of monetization. * Supply chain and shared components will remain frequent targets, with attackers targeting MSP‑adjacent ecosystems and trusted integrations like OAuth grants and SaaS connectors. * Scams and phishing will become multi‑channel and AI‑scaled due to industrialized impersonation across SMS, chat apps and collaboration platforms. ## Read the Acronis Cyberthreats Report H2 2025 For comprehensive and in-depth statistics, observations and tips on cybersecurity in the second half of 2025 as well as what’s to come, [read the Acronis Cyberthreats Report H2 2025](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/). [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) [Cyberthreats](https://www.acronis.com/en/blog/tags/cyberthreats/) [Cloud security](https://www.acronis.com/en/blog/tags/cloud-security/) ## Written by ![Image 4: Lee Pender](https://staticfiles.acronis.com/images/content/96b4b6d9ceee3c624b79f42543d1d633.png) Lee Pender Senior Content Marketing Manager Lee was a journalist in the technology industry for 15 years, writing for and managing publications that served both IT and partner audiences. His experience as a corporate content creator includes tenures with an MSP and a provider of tax-compliance services. He writes about a variety of topics for Acronis, including cybersecurity trends, MSP management, emerging technologies and product updates. [Previous post](https://www.acronis.com/en/blog/posts/partner-level-vulnerability-assessment-and-patch-management-for-msps-in-acronis-rmm/) [Partner-level vulnerability assessment and patch management for MSPs in Acronis RMM](https://www.acronis.com/en/blog/posts/partner-level-vulnerability-assessment-and-patch-management-for-msps-in-acronis-rmm/) [Next post](https://www.acronis.com/en/blog/posts/major-cyberthreats-to-anticipate-in-the-year-of-the-horse/) [Major cyberthreats to anticipate in the Year of the Horse](https://www.acronis.com/en/blog/posts/major-cyberthreats-to-anticipate-in-the-year-of-the-horse/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 5: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 6: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 7: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read