AI is increasing cyberattacks worldwide and Europe is one of the hardest hit regions. This is why

More than 8 million digital attacks hitthe world in the first half of 2025, with Europe being one of the hardest hit continents, according to a new report.  

Most of the attacks created outages that lasted between five and 15 minutes against telecommunications companies in Germany, France, Poland, Russia and Saudi Arabia. 

American cloud security company NETSCOUT found t that European, the Middle Eastern and African (EMEA) countries this year were hit with 3.2 million distributed denial of service (DDoS) schemes, attacks that overwhelm a targeted system, website or network. 

Artificial intelligence (AI) is driving cyberattacks and is , used by states and hacktivists to breach security on various fronts and spread attacks over multiple internet providers (IP) to avoid detection. 

The so-called DDoS attacks are now “precision-guided weapons of geopolitical influence capable of destabilising critical infrastructure,” which brings about an “unprecedented cyber risk” for organisations around the world, the company said in a press release. 

“As hacktivist groups leverage more automation, shared infrastructure, and evolving tactics, organisations must recognise that traditional defences are no longer sufficient,” Richard Hummel, director of threat intelligence at NETSCOUT, said in a press release. 

The report from NETSCOUT comes as AI company Anthropic said in its latest threat report that it stopped an operation in July that used its chatbot Claude to conduct large-scale theft and extortion of personal data unless victims paid ransoms that sometimes exceeded $500,000 ( almost €430,000). 

Malicious versions of ChatGPT being used to mount attacks

Hactivists are using AI assistants or large language models (LLMs) such as WormGPT and FraudGPT to coordinate their attacks, the report said. 

Rakesh Krishnan, a senior threat analyst at Indian company Netenrich, which discovered FraudGPT, describes it as an AI bot sold on the Dark Web that is built exclusively for “offensive purposes,”such as  crafting phishing emails, cracking passwords or using and collecting credit card information without permission. 

It t means a threat actor could draft an email using FraudGPT that sounds like a “short but professional message” to entice the recipient to click on a malicious link. 

Krishnam uses FraudGPT as an example in a blog post, writing a text message that represented the Bank of America, which asked a user to check out an important link to “ensure the security of your online banking account”. 

Daniel Kelley, a security researcher, wrote that WormGPT has many of the same features as FraudGPT but can also conduct business email compromise (BEC) attacks, where cybercriminals impersonate executives to get employees to send them money or data. 

These scams cost businesses “millions” every year, according to Microsoft’s security team, with many small companies unable to financially recover. 

Global events catalyst for spike in attacks

For the report, NETSCOUT collected data from its threat intelligence platform, which monitors “tens of thousands” of active and potential DDoS attacks every day, by testing how websites would react to an attack and collecting data from actual web traffic. 

It also tracks multiple “botnets,” or networks of infected computers that carry out attacks along with DDoS-for-hire services.

EMEA bore just under half of 2025’s DDoS attacks with3.2 million attacks, an 11 per cent decrease compared to the last few months of 2024. 

Global events were also major catalysts for cyberattacks, such as the World Economic Forum Davos conference in Switzerland, which saw more than 1,400 attacks - which is double the amount compared to the same period last year, WEF said.

Italy also sustained many DDoS attacks in February and March that were targeted at regional and local public bodies throughout the country, in response to what the company calls “a series of political discussions”. 

Outside of Europe, escalating regional conflicts between Pakistan and India, as well as between Iran and Israel, saw higher-than-average DDoS attacks. 

For example, the report found that Iran endured more than 15,000 cyberattacks since June 13, with 2,800 happening in just one day, suggesting that the country “is a primary target”.