--- title: "Acronis Report reveals that phishing and AI-powered social engineering are contributing to the rise in ransomware — ZEBR.ai" description: "Ransomware remains the primary threat to large and mid-sized businesses, with the most active hackers increasingly using AI to run low-cost, high-profit campaigns" url: "https://zebr.ai/en/blog/acronis-report-reveals-that-phishing-and-ai-powered-social-engineering-are-contributing-to-the-rise-in-ransomware" markdown_url: "https://zebr.ai/en/blog/acronis-report-reveals-that-phishing-and-ai-powered-social-engineering-are-contributing-to-the-rise-in-ransomware.md" language: "en" published: "2025-09-11T09:12:05+00:00" alternates: cs: "https://zebr.ai/cs/blog/report-acronis-odhaluje-ze-k-narustu-ransomwaru-prispivaji-phishing-a-socialni-inzenyrstvi-vyuzivajici-ai.md" sl: "https://zebr.ai/sl/blog/porocilo-acronis-razkriva-da-k-porastu-izsiljevalske-programske-opreme-prispevata-phishing-in-socialni-inzeniring-z-uporabo-ai.md" sk: "https://zebr.ai/sk/blog/sprava-acronis-odhaluje-ze-k-narastu-ransomveru-prispievaju-phishing-a-socialne-inzinierstvo-vyuzivajuce-ai.md" hr: "https://zebr.ai/hr/blog/izvjesce-acronis-otkriva-da-phishing-i-drustveni-inzenjering-koji-koriste-ai-doprinose-porastu-ransomwarea.md" sr-Latn: "https://zebr.ai/sr-latn/blog/izvestaj-acronis-otkriva-da-phishing-i-drustveni-inzenjering-uz-pomoc-ai-doprinose-porastu-ransomware-a.md" bs: "https://zebr.ai/bs/blog/izvjestaj-acronis-otkriva-da-phishing-i-drustveni-inzenjering-uz-pomoc-ai-doprinose-porastu-ransomwarea.md" sq: "https://zebr.ai/sq/blog/raporti-i-acronis-zbulon-se-phishing-u-dhe-inxhinieria-sociale-e-mbeshtetur-nga-ai-po-kontribuojne-ne-rritjen-e-ransomware.md" fr: "https://zebr.ai/fr/blog/le-rapport-acronis-revele-que-le-phishing-et-l-ingenierie-sociale-utilisant-l-ia-contribuent-a-l-augmentation-des-ransomwares.md" es: "https://zebr.ai/es/blog/el-informe-de-acronis-revela-que-el-phishing-y-la-ingenieria-social-basados-en-ia-contribuyen-al-aumento-del-ransomware.md" de: "https://zebr.ai/de/blog/acronis-bericht-zeigt-dass-phishing-und-ki-gestuetztes-social-engineering-zum-anstieg-von-ransomware-beitragen.md" pt-BR: "https://zebr.ai/pt-br/blog/relatorio-da-acronis-revela-que-phishing-e-engenharia-social-com-ia-contribuem-para-o-aumento-do-ransomware.md" pl: "https://zebr.ai/pl/blog/raport-acronis-ujawnia-ze-phishing-i-socjotechnika-wykorzystujace-ai-przyczyniaja-sie-do-wzrostu-ransomware.md" it: "https://zebr.ai/it/blog/il-report-acronis-rivela-che-phishing-e-ingegneria-sociale-basati-sull-ai-contribuiscono-all-aumento-del-ransomware.md" nl: "https://zebr.ai/nl/blog/acronis-rapport-onthult-dat-phishing-en-social-engineering-met-ai-bijdragen-aan-de-toename-van-ransomware.md" hu: "https://zebr.ai/hu/blog/az-acronis-jelentese-szerint-a-phishing-es-a-mesterseges-intelligenciat-hasznalo-social-engineering-hozzajarul-a-zsarolovirusok-terjedesehez.md" ro: "https://zebr.ai/ro/blog/raportul-acronis-dezvaluie-ca-phishingul-si-ingineria-sociala-bazate-pe-ai-contribuie-la-cresterea-ransomware-ului.md" tr: "https://zebr.ai/tr/blog/acronis-raporu-fidye-yazilimlarindaki-artisa-ai-destekli-kimlik-avi-ve-sosyal-muhendisliginin-katkida-bulundugunu-ortaya-koyuyor.md" id: "https://zebr.ai/id/blog/laporan-acronis-mengungkapkan-bahwa-phishing-dan-rekayasa-sosial-yang-memanfaatkan-ai-berkontribusi-terhadap-peningkatan-ransomware.md" --- [Home](https://zebr.ai/en/) [Blog](https://zebr.ai/en/blog) Acronis Report reveals that phishing and AI-powered social engineering are contributing to the rise in ransomware # Acronis Report reveals that phishing and AI-powered social engineering are contributing to the rise in ransomware [Acronis](https://zebr.ai/en/blog?tag=acronis) [press release](https://zebr.ai/en/blog?tag=press-releases) Ransomware remains the primary threat to large and mid-sized businesses, with the most active hackers increasingly using AI to run low-cost, high-profit campaigns 11/09/2025 · 3 min read · ZEBR.ai editorial team *Ransomware remains the primary threat to large and mid-sized businesses, with the most active hackers increasingly using AI to run low-cost, high-profit campaigns* **PRAGUE, September 11, 2025** – [**Acronis**](https://www.acronis.cz/)**,** a global leader in cyber protection solutions, has published the results of the **Acronis Cyberthreats Report for the first half of 2025**, detailing the most common threat vectors, active attacker groups and targeted industries in the first half of 2025. Ransomware remains the primary threat to large and mid-sized businesses, with new ransomware groups increasingly using artificial intelligence to automate their activities – phishing accounted for 25% of all attacks and 52% of attacks targeting MSPs, representing a 22% increase compared to the first half of 2024. The half-year report covers global threats detected by the Acronis Threat Research Unit (TRU) using Acronis sensors on Windows endpoints from January to May 2025. Based on data from more than\ 1,000,000 unique endpoints deployed around the world, the report also includes threat statistics focused on Windows operating systems, given their prevalence over MacOS and Linux. “While ransomware remains cybercriminals’ ultimate weapon, the way they deliver it is changing,” said **Gerald Beuchelt, CISO at Acronis**. “Even the least sophisticated attackers now have access to advanced artificial intelligence capabilities, generating social engineering attacks and automating their activities with minimal effort. As a result, organizations, MSPs, ISP providers and other entities are constantly exposed to sophisticated attacks, including increasingly advanced deepfake content, and one mistake is enough to jeopardize an organization’s entire future. To survive in this threat landscape and avoid damaging ransomware attacks, a comprehensive cyber protection strategy that includes advanced detection, response and recovery capabilities is essential.” Key findings of the Acronis Cyberthreats Report H1 2025 include: - **Ransomware remains at the top:** the number of publicly known ransomware victims rose by nearly 70% during the measured period compared to 2023 and 2024. The most active ransomware groups are Cl0p, Akira and Qlin. - **AI is driving the rise of social engineering**: ransomware gangs are increasingly using AI, which is reflected in their chosen threat vectors – the number of social engineering incidents and BEC attacks increased by 20% from January 2025 to May 2025 compared to the same period in 2024, likely due to increased use of AI to create convincing impersonations. Malware was discovered in 1.47% of Microsoft 365 email backups. - **MSPs under fire from phishing and BEC attacks**: while the total number of attacks targeting MSPs (managed service providers) declined during the measured period, the nature of the attacks changed significantly; phishing accounted for 52% of all attacks targeting MSPs, compared to 30% in 2024, while attacks using the Remote Desktop Protocol (RDP) nearly disappeared. - **Not all phishing attacks are the same**: while phishing is a favorite weapon of attackers, they are increasingly targeting collaboration applications and avoiding simple BEC campaigns. Nearly 25% of attacks in collaboration applications used AI-generated deepfake content or automated exploits. - **Manufacturing companies in the crosshairs:** the manufacturing sector was the most frequent target of ransomware gangs, accounting for 15% of all recorded cases in Q1 2025. Retail, food and beverage (12%), and telecommunications and media (10%) were also popular targets. For more information, see the full Acronis H1 2025 Cyberthreats Report, which you can download here: **.** Article author: ZEBR.ai editorial team Read on ## More related articles [All articles](https://zebr.ai/en/blog) Contact ## Do you need a solution for yourself or for your client? Tell us which service you are looking into, and a specialist in that area will get back to you directly. [(704) 745-4214](tel:+17047454214)\ --- - Source: - Site overview for AI agents: