A new global report on Ransomware 2025 from the cybersecurity company Acronis shows that the threat continues to dominate globally. At the same time, it is used AI to amplify social engineering attacks such as phishing, BEC and deepfakes – which creates a serious risk for companies in all industries.
Phishing attacks double against service providers
Acronis Cyberthreats Report H1 2025, based on data from over a million Windows devices worldwide, reveals that phishing now accounts for 25% of all attacks during the first half of 2025. For Managed Service Providers (MSPs) the development is even worse: phishing has increased from 30 % to the whole 52 % in just one year.
– The ultimate goal of cybercriminals is still ransomware, but the path to it has changed. Even inexperienced attackers can now use advanced AI tools to create deepfakes, automate phishing, and perform social engineering at scale. A single mistake can threaten an entire business, says Peter Graymon, General Manager Nordics at Acronis.
Ransomware 2025 continues to dominate the threat landscape
The report shows that the number of publicly known ransomware victims increased by almost 70 % compared to both 2023 and 2024.
The most active groups were Cl0p, Akira and Qlin.
- Manufacturing industry accounted for 15 % of the attacks in Q1 2025
- Retail and food was subjected to 12 %
- Telecom and media accounted for 10 % of the attacks
It is clear that Ransomware 2025 hits critical industries broadly and affects entire supply chains.
AI strengthens social engineering and BEC
The proportion of attacks involving social engineering and Business Email Compromise (BEC) rose from 20 % to 25,6 %. Almost a quarter of breaches in collaboration platforms used AI-generated deepfakes – manipulated audio, video and automated exploits – to bypass security solutions.
This shows that AI and ransomware 2025 creates a new type of threat where technology amplifies human weaknesses.
A holistic approach to cybersecurity is required
Acronis emphasizes the importance of a holistic cyber protection where detection, prevention, recovery and response are integrated. Companies must expect threats to become more sophisticated as AI makes it easier for attackers to scale their attacks.
Key insights from the Acronis Cyberthreats Report H1 2025
- Ransomware victims increased by 70 % compared to previous years
- Phishing stands for 25 % of all attacks – 52 % against MSPs
- Social engineering and BEC increased to 25.6 %
- Almost 25 % of the attacks in collaboration platforms contained AI deepfakes
- Manufacturing most vulnerable sector (15 % of attacks)
Swedish
Danish
Norwegian
Finnish
English
German
Dutch