The surge in cyber reconnaissance can be attributed to the widespread deployment of automated scanning tools by cybercriminals. In 2024, active scanning in cyberspace rose by 16.7% globally, with billions of scan attempts each month. This increase reflects a strategic shift where attackers are mapping exposed services, such as SIP and RDP, to identify vulnerabilities before patches can be applied.

Adversaries are increasingly using the darknet as a marketplace for resources that facilitate cyberattacks. This includes trading stolen credentials, corporate access, and exploit kits. In 2024, over 100 billion records were shared in underground forums, marking a 42% increase from the previous year. The darknet has transformed into a supply chain for cybercrime, allowing even less skilled attackers to access sophisticated tools and resources.

AI is reshaping the cyber threat landscape by enabling cybercriminals to automate various aspects of their operations. Tools like FraudGPT and BlackmailerV3 are being used to create convincing phishing emails and fraudulent communications. The use of AI has lowered the barrier to entry for cybercrime, allowing attackers with limited technical skills to execute sophisticated attacks, thereby increasing the volume and effectiveness of cyber threats.