# The 389% Ransomware Surge: What Fortinet's 2026 Threat Report Reveals About AI-Enabled Cybercrime ## The Numbers Are In — And They're Terrifying What if I told you that ransomware didn't just grow this year — it *exploded*? On April 30, 2026, Fortinet released its annual Global Threat Landscape Report. The headline number should make every CISO pause: **7,831 confirmed ransomware victims globally** — a **389% increase year-over-year** from approximately 1,600 victims in 2025. This isn't incremental growth. This is a hockey stick. ## From 4.76 Days to 24-48 Hours: The Compressed Attack Lifecycle FortiGuard Labs telemetry reveals that time-to-exploit (TTE) for critical outbreaks has collapsed from **4.76 days to just 24-48 hours**. AI isn't just helping attackers write better phishing emails — it's accelerating every phase of the attack lifecycle. The report documents real-world incidents where active exploitation attempts began **within hours** of vulnerability public disclosure. The React2Shell vulnerability wasn't a unique case — it's the new normal. ## The Shadow Agent Economy The most concerning finding isn't the numbers themselves — it's the *infrastructure* behind them. Fortinet identifies what they call "shadow agents" — AI-enabled offensive tools advertised as services on the dark web: - **WormGPT** and **FraudGPT** — now in enhanced versions - **HexStrike AI** — automated reconnaissance with attack path generation - **BruteForceAI** — LLM-powered intelligent form analysis for multi-threaded attacks These aren't tools for elite nation-state actors. They're crime-as-a-service platforms available to anyone with cryptocurrency. The barrier to entry for sophisticated attacks has collapsed. ## 67.65 Billion Brute Force Attempts — But Smarter, Not Harder Here's the paradox: FortiGate IPS telemetry recorded a **22% decrease in brute force attempts** year-over-year. Attackers aren't trying less — they're trying *smarter*. With AI-optimized targeting, criminals are making fewer attempts against better-selected targets. The success probability per credential tested has increased. Total global brute force events still hit approximately **67.65 billion** — about 185 million attempts per day. At the same time, global exploitation attempts increased **25.49%**. More effort on vulnerability exploitation, less on password guessing. That's a strategic shift that reflects where the easy wins are. ## Identity Sprawl: The Cloud's Achilles Heel FortiCNAPP intelligence confirms that throughout 2025, **most confirmed cloud incidents originated from stolen, exposed, or misused credentials** — not infrastructure exploitation. Hospitals, physician clinics, and retail establishments are the #1 targets. Why? Large identity populations, federated access models, and complex cloud integrations create attack surfaces that traditional network security can't protect. When your perimeter is identity, your firewall is irrelevant. ## The Stealer Log Economy: Context Is King FortiRecon dark web intelligence reveals a shift in the credential theft marketplace. Stealer logs — bundled identity material with contextual artifacts like browser data — now dominate dark web database activity at **67.12%** of advertised datasets, exceeding combolists (16.47%) and leaked credentials (5.96%). Why? Stealer logs enable *immediate replay*. An attacker doesn't just get a username and password — they get session cookies, browser fingerprints, and contextual data that bypasses MFA and behavioral detection. The top infostealers driving this: - **RedLine**: 911,968 infections (50.80%) - **Lumma**: 499,784 infections (27.84%) - **Vidar**: 236,778 infections (13.19%) ## Manufacturing and Business Services: The New Front Lines The top targeted sectors tell a story: 1. **Manufacturing**: 1,284 victims — operational technology meets ransomware 2. **Business Services**: 824 victims — MSPs and service providers as multiplier targets 3. **Retail**: 682 victims — payment data and operational disruption Geographic concentration includes the U.S. (3,381 victims), Canada (374), and Germany (291). But this is a global phenomenon — the report covers victims across dozens of countries. ## QR Code Phishing: The Fastest-Growing Vector Microsoft's Q1 2026 Email Threat Report (released the same day) complements Fortinet's findings with alarming detail: **QR code phishing more than doubled** during Q1 2026, surging from 7.6 million attacks in January to 18.7 million in March — a 146% quarterly increase. PDF attachments remain the dominant delivery method (70% in March), but a notable development was QR codes embedded directly in email bodies, which surged **336%** in March. No attachment needed — just a QR code that bypasses text-based email filters and redirects mobile users to credential harvesting sites. ## What Actually Works for Defense Fortinet's recommendations align with what we've been saying on this blog: - **Assume compromise** — design for breach, not prevention - **Identity-centric security** — your perimeter is now identity, not network - **AI-enabled defense** — you cannot fight machine-speed attacks with human-speed responses - **Credential theft prevention** — protect against infostealers with endpoint detection and browser isolation - **Zero Trust architecture** — verify every access request, regardless of source ## The Bottom Line The 389% ransomware increase isn't a spike — it's a signal. AI-enabled cybercrime has fundamentally altered the economics of attack. Shadow agents reduce operator skill requirements while increasing workflow speed. Crime service kits like WormGPT and FraudGPT democratize sophisticated attacks. The question for defenders isn't whether you'll be targeted. It's whether your defenses can operate at machine speed when the attackers do. As Derek Manky, Chief Security Strategist at Fortinet FortiGuard Labs, put it: "As cybercriminals increasingly use AI to bolster their tactics, cyber defenders must evolve cybersecurity operations into an industrialized defense and adopt AI-enabled tools that respond at the same velocity as modern threats." The velocity of modern threats just accelerated by 389%. --- *Sources: Fortinet 2026 Global Threat Landscape Report (April 30, 2026), Microsoft Threat Intelligence Q1 2026 Email Threat Report (April 30, 2026)*