AI in Cybercrime

6.5% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to assist with lateral movement.

67.3% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to write malware.

Across the period studied, the use of AI for account discovery rose 8.9% while AI-assisted phishing falls 8.6%.

In November 2025, a disrupted state-sponsored cyber espionage operation used 30 techniques across 13 tactics.

Least-skilled threat actors used about 16 distinct techniques on average, while the most skilled used about 20.

The share of actors classified as medium risk or higher increased from 33% in the first six-month period to 56% in the second six-month period, a roughly 1.7-fold increase.

80% of ransomware groups use AI, automation, or both in their attacks.

Threat actors utilizing AI and automation tools can achieve lateral movement within an organization in as little as 4 minutes, 85% faster than the previous year.