Threat reportRansomwareTL-2026-3961
Generative AI Used by Ransomware Operators to Build Custom Malware, Craft Phishing and Accelerate Data Theft (Zscaler ThreatLabz)
Generative AI Used by Ransomware Operators to Build Custom (TL-2026-3961), also tracked as GenAI-assisted ransomware, is a medium-severity ransomware operation, first published 2026-10-20. It has no confirmed attribution, affects Microsoft Windows (Quick Assist) / Microsoft Teams (abused as delivery, maps to 14 MITRE ATT&CK techniques (T1005, T1027, T1059.001), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3961
- Threat ID
- TL-2026-3961
- Also known as
- GenAI-assisted ransomware, Ransomware at machine speed
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, technology, freight-logistics, utilities, executives
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Generative AI Used by Ransomware Operators to Build Custom
Malware and tooling: AgendaCrypt, Akira, Python, inc ransom, Microsoft Teams, Quick Assist, Remote Monitoring and Management (RMM) software
How Generative AI Used by Ransomware Operators to Build Custom works
Zscaler research describes ransomware operators using generative AI to produce polished native-language phishing, to search compromised environments for the most valuable data, and to rapidly vary malware and scripts so that signature-based detection fails. The effect is a shorter path from initial access to data theft or encryption, and lower capability barriers for smaller groups.
This is a threat-trend entry, not a single campaign. It is based on a Zscaler blog post by Phil Hagen (Principal Information Security Researcher), published 2026-10-16 and titled 'Ransomware at machine speed: how GenAI shrinks the path after initial access'. The post draws on the Zscaler ThreatLabz 2026 Ransomware Report, released 2026-09-30, which analyzed activity from April 2025 to March 2026. Cyber Security News reported on the research on 2026-10-20. The blog names no specific malware families, CVEs, domains, IPs or file hashes.
The research identifies three phases where GenAI helps attackers. (1) Initial access and social engineering: GenAI produces emails, websites and other assets that are polished and written natively in the target's language, which makes phishing harder to tell from legitimate business communication. Phishing chains are described that lead victims to install legitimate remote monitoring and management (RMM) software, giving the attacker control of the system. (2) Post-compromise reconnaissance: GenAI can search all material the victim's system can reach to find the most valuable or sensitive data, which speeds up data theft. (3) Evasion and tooling: attackers can quickly create and revise scripts and malware, and the resulting variation in signatures defeats traditional antivirus and fuzzy-hashing detection. Custom code also complicates attribution, and smaller groups gain development capability that once needed substantial resources.
The ThreatLabz 2026 Ransomware Report, as summarized in Zscaler's press release, adds context. Data theft rose 275% year over year to about 896.2 TB. Blockchain-observed ransomware payments reached about $328 million, and the average payment rose 5.3% to $431,995. 7,366 victims were listed on leak sites, a 3% decline, and 52 newly active groups were identified. Qilin, Akira and INC Ransom were the top groups by victim volume and together accounted for 34% of disclosed victims. Manager-level and above employees made up 62% of victims. Manufacturing and Technology were the most targeted sectors; Freight & Logistics (+725%) and Utilities (+622%) grew fastest. 50.7% of activity targeted U.S. organizations, followed by Canada (4.8%), Germany (4.3%) and the U.K. (4.1%). The report names Microsoft Teams, Quick Assist and JavaScript/PowerShell/Python scripting as abused tools and languages. Zscaler's executive quote says that successful extortion is shifting away from file encryption toward less visible but more damaging data theft.
The sources do not link the GenAI findings to any named actor, so attribution is Unknown. The link between the AI-assistance findings and the named top ransomware groups is not established; those groups appear as report context only. Defenders should expect high variance in malware and script hashes, so they should rely on behavioral detection of RMM and Quick Assist abuse, Teams-delivered social engineering, script-interpreter abuse, bulk data discovery and staging, and exfiltration, and they should not rely on static signatures or hash matching. No network IOCs are published, so no BeaconBeagle correlation was possible.
MITRE ATT&CK techniques used in TL-2026-3961
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.001 PowerShell; T1059.006 Python; T1059.007 JavaScript; T1204 User Execution
Command and Control
Initial Access
T1566 Phishing; T1566.003 Spearphishing via Service
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1587.001 Malware; T1588.007 Artificial Intelligence
Impact
Affected products and versions in Generative AI Used by Ransomware Operators to Build Custom
- Microsoft — Windows (Quick Assist) / Microsoft Teams (abused as delivery and access channels)
Vulnerable versions: Not version-specific; abuse of legitimate features - Various — Legitimate RMM software (unspecified; abused after phishing-driven installation)
Vulnerable versions: Not version-specific
Remediation for Generative AI Used by Ransomware Operators to Build Custom
Immediate actions
- Restrict or application-allowlist RMM tools and Windows Quick Assist; alert on unapproved RMM installation
- Restrict external Microsoft Teams communication and require verification of help-desk contacts
- Alert on script interpreters (PowerShell, wscript/cscript JavaScript, Python) launched from user-writable paths or by Office, browser or RMM processes
- Prioritize behavioral and anomaly detection over static hash or signature matching
Workarounds
- Remove Quick Assist where it is not needed
- Block newly registered and uncategorized domains at the proxy
Longer-term hardening
- Deploy AI-based web-gateway and phishing-infrastructure detection and browser isolation for suspicious content
- Integrate security telemetry for faster investigation and automated response (SecOps automation)
- Apply data-loss prevention and data classification, and monitor for bulk file discovery, staging and exfiltration
- Give executives and managers targeted phishing and social-engineering training, since 62% of victims were manager-level or above
- Maintain tested offline backups and a ransomware response playbook
Timeline of Generative AI Used by Ransomware Operators to Build Custom
- Start of the April 2025 - March 2026 activity window analyzed by the Zscaler ThreatLabz 2026 Ransomware Report
- End of the report's analysis window, which covered 7,366 leak-site victims and 52 newly active groups
- The press release was syndicated by third-party outlets including Generation-NT and Autobound, and published in localized Zscaler editions (FR, DE, ES, IT, BR, MX, JP)
- Zscaler's press release stated that manager-level and above employees were 62% of victims and that Microsoft Teams and Quick Assist were abused for social engineering, lateral movement, data theft and file encryption; EVP Deepen Desai said extortion is shifting from encryption to data theft
- Zscaler released the ThreatLabz 2026 Ransomware Report: data theft up 275% to about 896.2 TB, about $328M in payments, Qilin, Akira and INC Ransom the top groups
- The Zscaler blog described three GenAI-assisted phases: polished native-language phishing leading to RMM installation, GenAI-driven search and classification of reachable data, and rapid bespoke malware and script variation that defeats signature and fuzzy-hash detection
- Phil Hagen of Zscaler published the blog 'Ransomware at machine speed: how GenAI shrinks the path after initial access', describing GenAI use in phishing, data discovery and malware variation
- Cyber Security News reported on the Zscaler findings that attackers use GenAI to build custom malware and bypass signature-based detection
Sources cited for Generative AI Used by Ransomware Operators to Build Custom
- Hackers Use Generative AI to Build Custom Malware and Bypass Traditional Security Detection
- Zscaler blog: Ransomware at machine speed - how GenAI shrinks the path after initial access (Phil Hagen)
- Zscaler Press Release: New Zscaler Report Reveals AI-Assisted Attackers Move to Massive Data Theft and Executive Targeting
- Zscaler Press Release (French edition)
- Generation-NT: New Zscaler report reveals AI-assisted attackers move to massive data theft
- Autobound: New Zscaler report reveals AI-assisted attackers move
- Zscaler ThreatLabz 2026 Ransomware Report (download page)
Detection coverage for TL-2026-3961
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3961 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.