AI-powered cybercrime has surged by 371% over the past five years, marking the emergence of what cybersecurity experts are calling the “fifth wave” of digital crime. Group-IB, a leading cybersecurity technology company, has released groundbreaking research revealing how artificial intelligence is fundamentally transforming the criminal ecosystem and making sophisticated attacks accessible to anyone with a credit card.
The company’s first whitepaper, “Weaponized AI: Inside the criminal ecosystem fuelling the fifth wave of cybercrime,” uncovers alarming trends in dark web activity. In 2025 alone, AI abuse dominated underground discussions with 23,621 first posts and 298,231 replies. Dark LLMs (Large Language Models) are now selling for as little as $30 per month, with a customer base exceeding 1,000 users.
The Evolution of AI-Powered Cybercrime
Over the past thirty years, cybercrime has evolved through successive waves—from manual phishing in the late 1990s to industrialized ransomware and supply chain attacks in the early 2020s. Unlike previous waves, AI adoption by threat actors has been strikingly fast. Group-IB’s research shows a ten-fold increase in dark web replies mentioning AI keywords, jumping from baseline levels to 1,199% growth since 2019.
The deepfake market exemplifies this explosive growth. 2024 saw the greatest year-on-year spike in deepfake services for sale at 233%, with 2025 continuing the upward trend with a 52% increase. Attackers are harvesting audio samples as short as 10 seconds from social media, webinars, or phone calls to create convincing voice clones.
Crimeware as a Service: The New Business Model
Group-IB investigations reveal that vendors are mimicking legitimate SaaS businesses, offering AI crimeware through pricing tiers, subscription models, and customer service support. These offerings fall into three main categories: LLM exploitation, phishing and social engineering automation, and malware development tools. Synthetic identity kits offering AI video actors, cloned voices, and biometric datasets are available for as little as $5.
Dark LLMs represent a particularly concerning development. Threat actors have moved beyond misusing chatbots to creating proprietary models with no ethical restrictions. At least three active vendors offer these services with subscriptions ranging from $30 to $200 per month. Jailbreak framework services that bypass legitimate LLM guardrails have also proliferated, with Q3 2025 volumes nearly equaling all of 2024.
“AI has industrialized cybercrime. What once required skilled operators and time can now be bought, automated, and scaled globally. While AI hasn’t created new motives for cybercriminals—money, leverage, and access still drives the ecosystem—it has dramatically increased the speed, scale, and sophistication with which those motives are pursued.”
Craig Jones, Former INTERPOL Director of Cybercrime
Defending Against the Fifth Wave
Weaponized AI presents a global challenge that no single organization can tackle alone. Unlike traditional malware, AI-enabled attacks leave minimal forensic traces, making detection and attribution significantly harder. Group-IB emphasizes the need for intelligence-led security strategies that combine predictive threat intelligence, fraud prevention, and deep visibility into underground ecosystems.
“From the frontlines of cybercrime, AI is giving criminals unprecedented reach. Today, AI is enabling criminals to scale scams with ease and create hyper-personalisation and social engineering to a new standard. Understanding this shift is essential to stopping the next generation of threats and ensuring defenders outpace attackers.”
Dmitry Volkov, CEO of Group-IB
Cross-border collaboration between the private sector, law enforcement agencies like INTERPOL and Europol, and regulators will be essential to counter this evolving threat. The research underscores an urgent need for defenders to adopt AI-driven detection capabilities and maintain comprehensive visibility into criminal ecosystems to stay ahead of increasingly sophisticated attacks.
