AI is helping attackers reimagine how cyberattacks are planned and executed, moving away from traditional mass malware infections toward targeted, machine-scale operations.

In 2025, most attacks on businesses were no longer driven by classic malware outbreaks. Instead, they were dominated by hands-on-keyboard intrusions, where human operators used legitimate tools, stolen credentials, and built-in system utilities to move through networks with minimal malware involved.

By the end of the year, AI started to automate and scale this approach:

• AI-driven ransomware appeared, enabling faster, more coordinated encryption campaigns.
• AI-generated phishing emails became standard, removing the spelling and grammar errors many users rely on to spot scams and making messages more personalized at scale.
• Deepfakes and synthetic content were increasingly used for social engineering, making it harder for employees to distinguish real communications from fake ones.
• AI systems began to outperform human vulnerability researchers, compressing the time from patch release to exploit development down to minutes in some cases.
• The first confirmed cases emerged of AI agents executing complex, multi-stage compromises with minimal human oversight.

This shift means organizations are now facing machine-scale adversaries that can learn, adapt, and operate continuously. Defenders need to respond in kind by investing in:

• Visibility across endpoints, networks, and cloud services to spot subtle, tool-based attacks.
• Resilience through strong backup, recovery, and business continuity planning.
• Automation in detection, response, and patching to keep pace with AI-accelerated threats.

The net effect: cybercrime is entering a machine-scale era where the volume, speed, and sophistication of attacks are increasingly driven by AI rather than manual effort alone.

The direct ransom payment is only one part of the cost of a modern cyberattack. The broader financial and operational impact is often much larger.

According to 2025 data cited in the report:

• The average ransom payment in the first half of 2025 was about $750,000 (USD).
• The average total cost of a data breach was roughly six times higher, at around $4.4 million (USD).

For small and medium-sized enterprises (SMEs), the impact is particularly acute:

• 80% of SMEs hit by ransomware paid a ransom.
• Only 60% of those that paid actually recovered their data.
• 1 in 3 faced substantial regulatory fines.
• Nearly 30% reported declines in sales, customer trust, or new-business opportunities.

Real-world incidents in 2025 show how these costs play out at scale:

• Healthcare: A ransomware attack on Kettering Health triggered a technology blackout across 14 hospitals, forcing staff to treat patients without digital records for nearly two weeks.
• Manufacturing: A cyberattack on Jaguar Land Rover halted production across multiple countries for five weeks, costing an estimated £50 million per week and creating a £2.5 billion impact on the UK economy.
• Food supply: An attack on United Natural Foods Inc. disrupted supply to about 30,000 locations, leading to an estimated $400 million in lost sales.
• Aviation: A cyber incident at a key aviation technology provider led to 50% of flights cancelled at some major European airports, stranding thousands of passengers.

Beyond the immediate financial hit, organizations also face:

• Project delays and missed deadlines.
• Lost contracts and churn among existing clients.
• Higher cyber insurance premiums and stricter underwriting.
• Long, complex recovery efforts that tie up IT and security teams.

In practice, the “cost of a cyberattack” is now measured not just in ransom or downtime, but in lost revenue, regulatory exposure, reputational damage, and ecosystem disruption across supply chains.

Modern ransomware operations are multi-stage, hands-on campaigns that rely heavily on legitimate tools rather than traditional malware. The report outlines a typical end-to-end flow:

1. Initial access
   Attackers commonly enter via:
   • Phishing (MITRE T1566) using familiar brands and realistic lures such as “secure document” links.
   • Exploiting vulnerabilities in internet-facing security appliances, especially Fortinet firewalls and SonicWall VPNs. In 2025, five Fortinet and four SonicWall flaws were added to the CISA Known Exploited Vulnerabilities Catalog, with several tied directly to ransomware campaigns.

   AI-generated emails increasingly remove obvious red flags and can redirect victims to fake but domain-matched login pages (e.g., Google or OneDrive), harvest credentials, then send users on to their real inbox to avoid suspicion.

2. Persistence
   Instead of obvious malware, attackers often use remote monitoring and management (RMM) tools such as ConnectWise or AnyDesk (MITRE T1219). These tools:
   • Provide full keyboard and mouse access.
   • Blend in with normal IT administration activity.
   • Can run in portable form (e.g., AnyDesk) without full installation, making them harder to spot.
3. Privilege escalation
   The goal is usually domain administrator access. Common techniques include:
   • Exploiting local vulnerabilities (MITRE T1068) to move from standard user to SYSTEM.
   • Abusing Windows token mechanisms (MITRE T1134) to impersonate SYSTEM.
   • Manipulating Kerberos (MITRE T1558.001, T1558.003) and extracting credentials via tools like Mimikatz (MITRE S0002) and LaZagne (MITRE S0349).
4. Lateral movement
   Attackers expand across the network using built-in tools:
   • PowerShell (T1059.001) and WMI (T1047) for remote command execution.
   • PsExec (T1021.002) and RDP (T1021.001) for remote access.
   • Post-exploitation frameworks like Cobalt Strike or Metasploit.

   This “living off the land” approach helps them look like normal admin activity while they harvest more credentials, map domain trusts (T1482), and sometimes target Active Directory databases (NTDS.dit, T1003.003).

5. Anti-forensics
   Before monetizing the attack, adversaries often cover their tracks by:
   • Clearing Windows event logs (T1070.001).
   • Deleting PowerShell histories and tampering with logs.
   • Disabling or weakening audit policies.

   This makes incident response and root-cause analysis slower and less precise.

6. Data exfiltration
   Data is usually stolen before it is encrypted, enabling double extortion (threatening leaks as well as downtime). Common methods include:
   • Using RMM tools’ built-in file transfer features (T1041).
   • Uploading data to trusted cloud platforms such as Google Drive, OneDrive, or Dropbox (T1567.002), which often bypass basic firewall rules.
7. Encryption (ransomware)
   The final stage is encrypting data and demanding payment (T1486). Before this, attackers typically:
   • Delete Volume Shadow Copies and cloud snapshots.
   • Disable or tamper with backup systems (T1490).

   A key trend in 2025: about 86% of encryption attacks were conducted remotely. Attackers increasingly stage encryption from unmanaged or EDR-less machines inside the network, using tools like PsExec so that the encryption work is performed by the target system’s kernel while the malicious process runs elsewhere. This makes it harder for endpoint tools to identify and quarantine the true source.

For defenders, this means focusing not just on blocking malware, but on:

• Reducing exploitable attack surface (patching, hardening, vulnerability management).
• Monitoring for suspicious use of legitimate tools (RMM, PowerShell, PsExec, RDP).
• Protecting and segmenting unmanaged or lightly monitored systems that attackers can use as staging points.
• Strengthening backup, recovery, and logging so that encryption and anti-forensic activity can be detected and contained quickly.