cyber.hendryadrian.com
Security Report · securityweek.com

FortiGuard Report: AI Accelerates Cybercrime as Exploit Times Fall to Hours

· Original article ↗

Summary

FortiGuard's 2025 analysis says AI and automation are industrializing cybercrime, with exploitation of many critical vulnerabilities occurring within 24–48 hours. It reports 7,831 confirmed ransomware victims and urges identity-focused detection, exposure reduction and,

Key points

  • FortiGuard analyzed 2025 data, or the most recent available 12-month period, from telemetry gathered by millions of sensors worldwide.
  • The report describes malicious AI tools used for phishing, code generation, social engineering, automated reconnaissance and attack-path generation.
  • FortiGuard says critical-vulnerability exploitation timelines have fallen to 24–48 hours, with some exploitation beginning within hours of public disclosure.
  • The report says 656 vulnerabilities were discussed on the darknet in 2025; 344 had publicly available proof-of-concept code and 176 had working exploit code.
  • Infostealers including RedLine, Lumma and Vidar supply credentials and access that brokers sell, often for corporate VPNs and RDP.
  • FortiGuard reports 7,831 confirmed ransomware victims in 2025 and identifies Qilin, Akira and Safepay as the most active groups.
  • Recommended defenses include prioritizing identity-centric detection, reducing exposure and using automation to improve detection and response speed.

Article Details

Publisher
FortiGuard
Report Period
2025, or the most recent 12-month window available per dataset
Scope
Global cybercrime threat landscape across multiple security domains and vectors of compromise
Sample Size
Telemetry from millions of sensors deployed worldwide
Key Statistics
  • FortiGuard reports 656 vulnerabilities were actively discussed on the darknet in 2025; 344 (52.44%) had public PoC exploit code, 176 (26.83%) had working exploit code, and 149 (22.71%) had both.
  • The report records 7,831 confirmed ransomware victims globally in 2025, including 3,381 in the US.
  • The report says time-to-exploit for most critical vulnerabilities has fallen to 24–48 hours; in some cases, exploitation begins within hours of public disclosure.
Recommendations
  • Prioritize identity-centric detection.
  • Reduce exposure.
  • Use defensive AI and automation to match the speed of adversarial operations.

People

Derek MankyChief Security Strategist at FortiGuard Labs; commented on malicious actors beginning to use agentic AI for more sophisticated attacks.Douglas SantosDirector of advanced threat intelligence at FortiGuard; commented on the reported decline in time-to-exploit.

Threat Actors

AkiraIdentified in the report as one of the three most active ransomware groups in 2025.QilinIdentified in the report as one of the three most active ransomware groups in 2025.SafepayIdentified in the report as one of the three most active ransomware groups in 2025.

Malware

LummaThis data is primarily obtained via infostealers such as RedLine (the most prolific), Lumma and Vidar.RedLineThis data is primarily obtained via infostealers such as RedLine (the most prolific), Lumma and Vidar.VidarThis data is primarily obtained via infostealers such as RedLine (the most prolific), Lumma and Vidar.

Vendors

FortiGuardFortiGuard has analyzed the current threat landscape targeted by cybercrime using telemetry from millions of sensors deployed worldwide since 2002.

Tools

Apex AIA range of AI-enabled malicious tools are now available to cybercriminals, such as WormGPT (Official), FraudGPT, HexStrike AI, APEX AI, and BruteForceAI.BruteForceAIA range of AI-enabled malicious tools are now available to cybercriminals, such as WormGPT (Official), FraudGPT, HexStrike AI, APEX AI, and BruteForceAI.FraudGPTA range of AI-enabled malicious tools are now available to cybercriminals, such as WormGPT (Official), FraudGPT, HexStrike AI, APEX AI, and BruteForceAI.HexStrike AIA range of AI-enabled malicious tools are now available to cybercriminals, such as WormGPT (Official), FraudGPT, HexStrike AI, APEX AI, and BruteForceAI.Nessussoftware versions and misconfigurations; Nmap for port scanning and service fingerprinting; and Nessus and OpenVAS for vulnerability enrichment.Nmapwith standard commercial tools: Qualys to locate vulnerable software versions and misconfigurations; Nmap for port scanning and service fingerprinting; and Nessus and OpenVAS for vulnerability enrichment.OpenVASversions and misconfigurations; Nmap for port scanning and service fingerprinting; and Nessus and OpenVAS for vulnerability enrichment.QualysFinding vulnerabilities to target is automated through global scanning with standard commercial tools: Qualys to locate vulnerable software versions and misconfigurations; Nmap for port scanning and serviceWormGPT (Official)A range of AI-enabled malicious tools are now available to cybercriminals, such as WormGPT (Official), FraudGPT, HexStrike AI, APEX AI, and BruteForceAI.

Countries

CanadaThe three most active ransomware groups were Qilin, Akira and Safepay, and the most targeted geographic areas were the US (3,381 victims), Canada and Europe.

Related Articles