AI-Powered Cyberattacks in 2025: Key Takeaways from the ENISA and OpenAI Reports

AI: A New Weapon for Cybercriminals and Defenders Alike. The 2025 Threat Landscape

Welcome to the digital world of 2025, where the front line in the fight to protect data moves at the speed of light. If you thought the cyber threat landscape was complicated enough already, buckle up. The World Economic Forum (WEF) warns that cyberattacks have surged in recent years, with the average number of weekly attacks per organization more than doubling in just four years. These are no longer isolated skirmishes. This is a sustained, global digital war. And a powerful new player has entered the battlefield and is changing the rules of the game: artificial intelligence.

Like the mythical Janus, AI has two faces. On one side, it has become a dream tool for hackers, fraudsters and state-backed operators, letting them automate, scale and refine their attacks to an unprecedented degree. On the other, it gives defenders a powerful weapon for analyzing, predicting and neutralizing threats. Extensive new reports published in recent weeks by the European Union Agency for Cybersecurity (ENISA) and the OpenAI research lab shed light on this new reality. Let's look at what they tell us about the nature of today's threats and the role AI plays in them.

The 2025 Threat Landscape: What Does the ENISA Report Say?

Before we dive into the intricacies of artificial intelligence, let's step back and look at the bigger picture painted by ENISA's annual Threat Landscape report. Based on an analysis of nearly 5,000 incidents between July 2024 and June 2025, the agency identifies several key trends that define today's battlefield.

1. DDoS and Ideology Dominate: By sheer number of incidents (a full 77%!), DDoS (Distributed Denial of Service) attacks reign supreme. Interestingly, their main driver is not profit but ideology. Hacktivists are responsible for the overwhelming majority of these operations, which account for almost 80% of all ideologically motivated incidents. Their most frequent targets are the websites of public administrations in EU member states. Although these attacks generate plenty of media noise, their real-world impact is often limited: only 2% of them actually disrupt services. In other words, we are dealing with a loud but often harmless form of digital protest, driven chiefly by the NoName057(16) group, which is behind more than 60% of the claims.

2. Ransomware: The King of Destruction: If DDoS is a noisy street protest, ransomware is a quiet but deadly effective killer. ENISA leaves no doubt: ransomware is the most severe and destructive threat in the European Union. Despite an 11% year-over-year drop in the number of attacks, their destructive power remains enormous. Groups such as those behind the Akira and SafePay strains cripple companies and institutions (local governments in particular), causing real losses running into the millions and prolonged operational disruption.

3. Phishing: The Master Key That Never Fails: How do cybercriminals get in? Good old phishing is still riding high. A full 60% of successful intrusions start with a fake email, text message or ad. It is proof that people remain the weakest link. On top of that, the rise of Phishing-as-a-Service (PhaaS) models means that even novice criminals can now buy ready-made kits for running professional-looking campaigns, dramatically lowering the barrier to entry into cybercrime.

4. Public Administration and State Actors in the Crosshairs: Who is the primary target? The public sector. A full 38.2% of all recorded incidents were aimed at central and local government institutions. They draw the attention of both the hacktivists mentioned above and far more dangerous players: groups linked to foreign states (state-nexus actors). According to ENISA, these advanced groups, such as the notorious APT28 (Fancy Bear), APT29 (Cozy Bear) and Sandworm, attributed to Russian intelligence services, were among the most active in the EU, conducting sophisticated cyber-espionage operations against diplomatic, defense and telecommunications targets.

Artificial Intelligence: A Digital Accelerator for Bad (and Good)

The ENISA report makes it clear that the growing role of AI is a key trend shaping how threats evolve. This is confirmed by a striking report OpenAI published almost simultaneously, "Disrupting malicious uses of AI," which uses concrete examples to show how versatile and dangerous large language models (LLMs) such as ChatGPT have become in the wrong hands.

AI as an Attack Tool

Criminals are not building their operations around AI from scratch. Instead, as OpenAI notes, they are weaving language models into their existing workflows, making them faster, more efficient and harder to detect.

Phishing and Social Engineering on Steroids: Remember those clumsy phishing emails riddled with grammar mistakes that you could spot a mile away? Those days are fading fast. LLMs can generate flawlessly written, personalized and culturally tailored messages in any language. ENISA estimates that by early 2025, AI-assisted phishing campaigns already accounted for more than 80% of all observed social engineering activity!

OpenAI describes a Chinese group (linked to UNK_DROPPITCH) that used ChatGPT to craft phishing emails in Chinese, English and Japanese, precisely adjusting tone and regional expressions to target the semiconductor sector in Taiwan and US academic institutions.

Support for Malware Developers: AI models have become a kind of smart coding assistant for hackers. OpenAI banned accounts belonging to a Russian-speaking criminal group that used ChatGPT to prototype and debug malware components: remote access trojans (RATs), credential stealers and detection evasion features. Importantly, the model refused to generate outright malicious code. The criminals got around this safeguard by asking for individual "building blocks," snippets of code that are neutral on their own (such as converting executables into shellcode), which they then assembled into a lethal whole outside the platform. Similar techniques were observed among Korean-speaking operators, who used AI to work on implants, browser credential theft routines and fake verification pages.

Disinformation and Influence Operations (IO): Artificial intelligence is a dream tool for any propaganda machine. "Stop News," the Russian operation OpenAI already reported on in 2024, is back. This time, the operators used ChatGPT to write scripts for short, news-style videos, which they then published on YouTube and TikTok. The content, translated into French by AI, praised Russia's role in Africa while criticizing France and the US. In more advanced cases, the AI even generated detailed prompts for... other AI models, this time for video generation, which shows how increasingly complex these operations are becoming.

Another example is the Chinese operation "Nine-emdash Line." Its goal was to mass-produce English-language social media posts that inflamed territorial disputes in the South China Sea, criticized the President of the Philippines and discredited pro-democracy activists in Hong Kong.

Global Fraud on an Industrial Scale: AI has also democratized large-scale fraud. OpenAI identified and blocked scammer networks operating out of Cambodia, Myanmar and Nigeria. They used language models to translate and create content for fake investment websites, chat with victims and send messages in bulk.

One Cambodian gang went a step further. It set up a fake WhatsApp discussion group in which supposed "investors" (actually bots) held lively, fully AI-generated conversations about their profits to make the scam look credible to a newly added victim. Even more shocking, one scam center in Myanmar used ChatGPT not only to defraud people but also to... run its day-to-day operations: drawing up schedules, assigning desks and dormitory beds to workers, and even asking the model about potential penalties for cybercrime.

AI in the Hands of Authoritarian Regimes: Perhaps the most chilling use of AI is its deployment by authoritarian regimes for control and surveillance. OpenAI identified users linked to the government of the People's Republic of China who tried to use ChatGPT to design mass monitoring tools. One of them asked for help drafting a plan for a social media "probe" that would scan Twitter/X, Facebook and other platforms for "extremist speech" as well as ethnic, religious and political content.

Another user asked the AI to draft a proposal for a "High-Risk Uyghur-Related Inflow Warning Model." The tool was meant to analyze transportation bookings and cross-reference them with police data in order to track the movements of members of this ethnic minority.

Evolution and Adaptation: The Cybercriminal Game of Cat and Mouse

What makes these new threats especially worrying is how quickly criminals learn and adapt. They are not just using AI; they are also learning how to hide that they use it, making their activity even more convincing. The OpenAI report reveals a fascinating "meta" thread in this evolution.

Scam operators in Cambodia began instructing AI models to strip out the characteristic em dashes from generated text, since these had become an informal telltale sign of AI-generated content in online discussions. It is a small but significant detail. It shows that criminals actively follow the public debate about AI and adjust their tactics in real time to avoid detection. Similarly, after their WhatsApp groups were banned, the scammers used AI to generate excuses, claiming they had been the victims of false reports filed by competitors. This ability to respond dynamically and spin fake narratives in reaction to defensive measures makes fighting them even harder.

AI as the Defender's Shield

Fortunately, that is only one side of the coin. The same technology that powers attacks is becoming defenders' most powerful ally. According to the WEF, companies are investing heavily in AI-based cybersecurity solutions to strengthen their defenses. But the real cause for hope comes from another OpenAI finding.

It turns out that ChatGPT is used to identify and expose scams up to three times more often than to create them! Ordinary users paste suspicious text messages and emails into the chat window, and the model analyzes the message point by point, flagging every red flag: grammar mistakes, suspicious links, manipulation techniques and attempts to phish for data. It is a remarkable example of how access to advanced technology can raise awareness and resilience across society as a whole.

The Human and Economic Side of Cybersecurity

Amid all this talk of algorithms, neural networks and automated attacks, it is easy to forget the most important pieces of the puzzle: people and money.

You Are the Weakest Link: Despite increasingly advanced hacking techniques, phishing and credential theft remain the most common way in. This shows that our inattention, haste and lack of skepticism are cybercriminals' most valuable asset. As Ivan John Uy, the former Philippine Secretary of Information and Communications Technology, aptly put it: "Cybersecurity is not a technical skill but a life skill."

The Talent Crisis and Economic Pressure: The second human problem is a severe shortage of specialists. In its "Global Cybersecurity Outlook 2025" report, the WEF warns that the lack of skilled staff is one of the main obstacles to building digital resilience. Only 14% of organizations believe they have the skills needed to deal with cyber threats. This gap has real economic consequences. Companies are forced to increase their cybersecurity budgets (confirming the upward trend from 2021 to 2025), yet they struggle to find people who can put those budgets to effective use. The result is rising cyber insurance costs, and boards are being pushed to treat cyber risk as a core element of business strategy and business continuity planning.

Conclusion: An Arms Race in the Age of AI

2025 undoubtedly marks the start of a new era in cybersecurity, one dominated by artificial intelligence. We are witnessing a classic arms race. Criminals are using AI to create more polished phishing campaigns, write malware and run disinformation operations on an unprecedented scale. Defenders are responding by harnessing the same capabilities to analyze anomalies, detect threats in real time and educate the public.

In this new, fast-moving landscape, governments are also trying to keep up by introducing new regulations such as the EU Cyber Resilience Act and the AI Act. However, technology and criminal tactics are evolving faster than the legislative process.

That is why one thing remains constant: the fundamentals of security. Regular software updates, good cyber hygiene, strong authentication and, above all, ongoing education and healthy skepticism. AI can be a powerful tool, but in the end it is human decisions that determine whether it becomes our shield or a sword in the enemy's hand.