H2 2025 data highlights a surge in email-based attacks, growing use of AI in criminal workflows, and high MSP and supply chain exposure
Acronis, global leader in the cybersecurity and in the data protection, published theAcronis Cyberthreats Report H2 2025: From exploits to malicious AI, the semi-annual report that analyzes threat activity globally based on telemetry data collected by proprietary sensors and analyzed by the Acronis Threat Research Unit (TRU). The document highlights the main trends observed in 2025, with a specific focus on the second half of the year.
The results show a sustained and further increasing growth in cyber attacks. Email-based attacks increased 16% per organization and 20% per user year-on-year, while phishing remained the primary entry point, responsible for 52% of attacks targeting Managed Service Providers (MSPs). Advanced attacks on collaboration platforms rose from 12% in 2024 to 31% in 2025, signaling a shift towards secondary but high-impact channels.
Below are some of the main cybersecurity trends in 2025:
- PowerShell abuse in focus: PowerShell remains the most exploited legitimate tool globally, particularly in Germany, the United States and Brazil.
- Phishing still dominant: in the second half of 2025, 83% of threats conveyed via email are attributable to phishing.
- Critical Vulnerabilities in MSPs: All MSP-related CVEs made public in 2025 were classified as High or Critical, despite the low overall number.
- AI enters criminal workflows: AI is increasingly being integrated into attackers' operational activities, from reconnaissance to ransom negotiations to social engineering campaigns.
- Most exposed geographical areas: India, the United States and the Netherlands have the highest rates of massive infections and lateral movement, while South Korea is the country with the highest incidence of malware, with 12% of users affected.
- Sectors under pressure: Production, technology and healthcare are among the main targets of ransomware, also due to the operational continuity required and the complexity of distributed environments.
There has also been a drastic increase in AI-assisted cybercrime in 2025. Malicious actors have used AI to scale up attacks, automate reconnaissance activities, and optimize extortion strategies. GLOBAL GROUP, for example, employed AI-based systems to efficiently manage multi-victim ransomware negotiations, while GTG-2002 leveraged AI-assisted reconnaissance and data exfiltration techniques to maximize the impact of operations. Social engineering has also seen an evolution: in fake kidnapping scams, "proof of life" images have been generated via AI, increasing the psychological pressure on victims. These developments highlight a new phase of cybercrime, in which speed, sophistication and scale put traditional defenses under pressure.
“In 2025, we've seen an acceleration in the evolution of threats as attackers aren't just extending established methods like phishing and ransomware, they're integrating AI to operate faster, more efficiently, and at scale,” said Gerald Beuchelt, CISO at Acronis. "The systematic integration of AI into criminal operations marks the entry into a new phase of cybersecurity. This change requires organizations to anticipate threats, automate defenses and develop resilient systems, capable of dealing with both traditional and AI-based attacks."
Ransomware remains the prevalent attack type. Globally, nearly 150 MSPs and telecom operators have been directly targeted and over 7,600 victims have been made public. Among the most active groups are Qilin (962 victims), Akira (726) and Cl0p (517). The manufacturing, technology and healthcare sectors are significantly affected, with the United States recording 3,243 fatalities, the highest number. New ransomware groups emerged in H2 2025, including Sinobi, TheGentlemen, and CoinbaseCartel.
Supply chain and MSP attacks remain a major concern. Attackers exploited RMM tools such as AnyDesk and TeamViewer and affected over 1,200 third-party and supply chain victims; the United States records the highest exposure (574 cases). Akira and Cl0p are among the main players and the risk for MSPs and end customers remains high.
