Acronis H2 2025 Cyberthreats Report: Cyberattacks Surge as Phishing, Ransomware, and AI-Driven Threats Escalate
Acronis H2 2025 Cyberthreats Report: Cyberattacks Surge as Phishing, Ransomware, and AI-Driven Threats Escalate
Global organizations face AI-enhanced cybercrime, record ransomware incidents, and an uptick in phishing attacks, highlighting the need for strong cyber defenses
SCHAFFHAUSEN, Switzerland, Feb. 18, 2026 (GLOBE NEWSWIRE) -- Acronis , a global leader in cybersecurity and data protection , released its biannual report, “ Acronis Cyberthreats Report H2 2025: From exploits to malicious AI ”, analyzing global threat activity based on telemetry collected by the Acronis Threat Research Unit (TRU) and Acronis sensors. The report highlights key trends observed throughout 2025, with a focus on the second half of the year.
The findings reveal a continued surge in cyberattacks. Email-based attacks increased 16% per organization and 20% per user year-over-year, while phishing remained the leading entry point, responsible for 52% of attacks targeting managed service providers (MSPs). Advanced attacks on collaboration platforms jumped from 12% in 2024 to 31% in 2025, signaling a shift toward high-impact secondary attack channels.
Key cybersecurity trends in 2025 include:
2025 also saw a dramatic rise in AI-assisted cybercrime. Threat actors leveraged AI to scale attacks, automate reconnaissance, and optimize extortion strategies. For example, GLOBAL GROUP used AI-driven systems to manage ransomware negotiations efficiently across multiple victims, while GTG-2002 employed AI-assisted reconnaissance and data exfiltration to maximize impact. Even social-engineering attacks evolved: virtual kidnapping scams used AI to generate convincing “proof of life” images, deceiving victims and amplifying psychological pressure. These innovations highlight a new era of cybercrime, where speed, sophistication, and scale challenge traditional defenses.
“As cyber threats evolve at an accelerated pace, 2025 has shown that attackers are not only scaling traditional methods like phishing and ransomware, but are leveraging AI to act faster, more efficiently, and at greater scale,” said Gerald Beuchelt, CISO at Acronis. “Attackers are increasingly integrating AI into their operations, so the cybersecurity landscape is entering a new era. This shift requires organizations to anticipate threats, automate defenses, and build resilient systems capable of withstanding both traditional and AI-driven attacks.”
Ransomware continued to dominate the threat landscape. Nearly 150 MSP and telecom organizations were directly targeted, while over 7,600 victims were publicly disclosed globally. The most active ransomware groups included Qilin (962 victims), Akira (726), and Cl0p (517). Manufacturing, technology, and healthcare sectors were disproportionately affected, with the United States recording the highest number of victims at 3,243. New ransomware groups also emerged in H2 2025, including Sinobi, TheGentlemen, and CoinbaseCartel.
Supply chain and MSP-targeted attacks remain a significant concern. Attackers exploited RMM tools such as AnyDesk and TeamViewer, impacting over 1,200 third-party and supply chain victims, with the U.S. seeing the greatest exposure at 574 victims. Akira and Cl0p were the dominant actors in these attacks, underscoring the persistent risk to MSPs and their clients.
Acronis Press : Julia Carfagno Senior Global Communications Manager Julia.Carfagno@acronis.com
A photo accompanying this announcement is available at
Equinox Gold Announces Inaugural Quarterly Cash Dividend of US$0.015 per Common and Application for Normal Course Issuer Bid
Tenaris Announces 2025 Fourth Quarter and Annual Results
Monument Mining Limited Recognized as Top 50 TSX Venture Company
AMG Schedule for Fourth Quarter and Full Year 2025 Earnings Release
SiriusPoint Reports Fourth Quarter 2025 Net Income of $240m, Return on Equity of 44.9% and Operating Return on Equity of 17.1%
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information us.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
