# Generative AI Used by Ransomware Operators to Build Custom Malware, Craft Phishing and Accelerate Data Theft (Zscaler ThreatLabz)

> Zscaler research describes ransomware operators using generative AI to produce polished native-language phishing, to search compromised environments for the most valuable data, and to rapidly vary malware and scripts so that signature-based detection fails. The effect is a shorter path from initial access to data theft or encryption, and lower capability barriers for smaller groups.

- **Published:** 2026-10-20T13:49:55Z
- **Last reviewed:** 2026-10-20T13:49:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3961
- **ID:** TL-2026-3961
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a threat-trend entry, not a single campaign. It is based on a Zscaler blog post by Phil Hagen (Principal Information Security Researcher), published 2026-10-16 and titled 'Ransomware at machine speed: how GenAI shrinks the path after initial access'. The post draws on the Zscaler ThreatLabz 2026 Ransomware Report, released 2026-09-30, which analyzed activity from April 2025 to March 2026. Cyber Security News reported on the research on 2026-10-20. The blog names no specific malware families, CVEs, domains, IPs or file hashes.

The research identifies three phases where GenAI helps attackers. (1) Initial access and social engineering: GenAI produces emails, websites and other assets that are polished and written natively in the target's language, which makes phishing harder to tell from legitimate business communication. Phishing chains are described that lead victims to install legitimate remote monitoring and management (RMM) software, giving the attacker control of the system. (2) Post-compromise reconnaissance: GenAI can search all material the victim's system can reach to find the most valuable or sensitive data, which speeds up data theft. (3) Evasion and tooling: attackers can quickly create and revise scripts and malware, and the resulting variation in signatures defeats traditional antivirus and fuzzy-hashing detection. Custom code also complicates attribution, and smaller groups gain development capability that once needed substantial resources.

The ThreatLabz 2026 Ransomware Report, as summarized in Zscaler's press release, adds context. Data theft rose 275% year over year to about 896.2 TB. Blockchain-observed ransomware payments reached about $328 million, and the average payment rose 5.3% to $431,995. 7,366 victims were listed on leak sites, a 3% decline, and 52 newly active groups were identified. Qilin, Akira and INC Ransom were the top groups by victim volume and together accounted for 34% of disclosed victims. Manager-level and above employees made up 62% of victims. Manufacturing and Technology were the most targeted sectors; Freight & Logistics (+725%) and Utilities (+622%) grew fastest. 50.7% of activity targeted U.S. organizations, followed by Canada (4.8%), Germany (4.3%) and the U.K. (4.1%). The report names Microsoft Teams, Quick Assist and JavaScript/PowerShell/Python scripting as abused tools and languages. Zscaler's executive quote says that successful extortion is shifting away from file encryption toward less visible but more damaging data theft.

The sources do not link the GenAI findings to any named actor, so attribution is Unknown. The link between the AI-assistance findings and the named top ransomware groups is not established; those groups appear as report context only. Defenders should expect high variance in malware and script hashes, so they should rely on behavioral detection of RMM and Quick Assist abuse, Teams-delivered social engineering, script-interpreter abuse, bulk data discovery and staging, and exfiltration, and they should not rely on static signatures or hash matching. No network IOCs are published, so no BeaconBeagle correlation was possible.

## MITRE ATT&CK

- T1587.001 Malware
- T1588.007 Artificial Intelligence
- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1059.006 Python
- T1027 Obfuscated Files or Information
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1204 User Execution
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Hackers Use Generative AI to Build Custom Malware and Bypass Traditional Security Detection](https://cybersecuritynews.com/hackers-use-generative-ai/)
- [Zscaler blog: Ransomware at machine speed - how GenAI shrinks the path after initial access (Phil Hagen)](https://www.zscaler.com/blogs/security-research/ransomware-machine-speed-how-genai-shrinks-path-after-initial-access)
- [Zscaler Press Release: New Zscaler Report Reveals AI-Assisted Attackers Move to Massive Data Theft and Executive Targeting](https://www.zscaler.com/press/new-zscaler-report-reveals-ai-assisted-attackers-move-massive-data-theft-executive-targeting)
- [Zscaler Press Release (French edition)](https://www.zscaler.com/fr/press/new-zscaler-report-reveals-ai-assisted-attackers-move-massive-data-theft-executive-targeting)
- [Generation-NT: New Zscaler report reveals AI-assisted attackers move to massive data theft](https://www.generation-nt.com/communiques-presse/new-zscaler-report-reveals-ai-assisted-attackers-move-to-massive-data-2081994)
- [Autobound: New Zscaler report reveals AI-assisted attackers move](https://www.autobound.ai/companies/zscaler/news/new-zscaler-report-reveals-ai-assisted-attackers-move-74deaf40)
- [Zscaler ThreatLabz 2026 Ransomware Report (download page)](https://www.zscaler.com/campaign/threatlabz-ransomware-report)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3961