Cybercriminals are faster with AI: fastest attack in 2025 occurred in 27 seconds | artificial intelligence | malware

The average access time to enterprise assets by cybercriminal groups dropped to just 29 minutes in 2025, 65 percent faster than in 2024. The fastest observed occurred in just 27 seconds.

LOOK: Chinese New Year 2026: the impressive choreography of humanoid robots | VIDEO

This data is collected in the ‘Global Threat Report 2026’ that the cybersecurity manufacturer CrowdStrike published this Tuesday, in which it highlights that, as innovation accelerates, exploitation by cybercriminals advances at the same pace.

Criminals increased their AI-enabled operations by 89 percent over last year, mostly using AI as a weapon in reconnaissance, credential theft and evasion as attack vectors.

The report gives as an example Russian-linked actor FANCY BEAR, which used LAMEHUG, a large language model (LLM)-enabled malware, to automate document recognition and collection.

He also cites the case of the PUNK SPIDER actor, who used AI-generated ‘scripts’ to speed up the dumping of credentials and erase forensic evidence; and North Korea-linked actor FAMOUS CHOLLIMA, which employed AI-generated identities to escalate internal operations.

Intrusions now travel through trusted identities, ‘Software as a Service’ (SaaS) applications and cloud infrastructures, blending in with normal activity while reducing the ability of security managers to respond.

Criminals are also actively exploiting artificial intelligence systems themselves, injecting malicious prompts into generative AI tools in more than 90 organizations and abusing generative AI development platforms.

They also exploited vulnerabilities in AI development platforms to establish persistence and deploy ransomware, and published malicious AI servers that impersonated trusted services to intercept sensitive data.

The report is based on top-line intelligence from CrowdStrike’s threat and intelligence teams, which track more than 280 identified groups. This has also made it possible to identify an increase in operations linked to China (38%) and North Korea (more than 130%).

Likewise, it reflects the growth of ‘zero-days’ and exploitation in the cloud. Specifically, it indicates that 42 percent of the vulnerabilities were exploited before public disclosure, as cybercriminals used zero-day attacks for initial access, remote code execution, and privilege escalation.

Cloud-targeted intrusions increased 37 percent overall, with a 266 percent increase by state-linked actors attacking cloud environments for intelligence gathering.