Ransomware operators are using generative AI to sharpen phishing campaigns, speed up reconnaissance, and identify sensitive corporate information to steal.
Zscaler ThreatLabz describes a shift toward faster, more selective extortion, where attackers prioritize damaging disclosures rather than relying exclusively on file encryption.
That represents a 275.8% annual increase. These figures establish the scale of theft, but do not measure how much resulted from AI assistance.
After establishing access, attackers can use generative AI to classify accessible documents and search for commercially valuable or sensitive information.
Instead of manually reviewing sprawling repositories, operators can prioritize material whose exposure would create significant business, reputational, or regulatory pressure.
This activity remains post-compromise reconnaissance: AI helps determine what deserves attention after an account or endpoint has been breached.
Its reach depends on the permissions available to the compromised identity, making excessive access rights particularly consequential.
The distinction matters because encryption is no longer necessary for a successful extortion attempt.
In a related analysis, Zscaler described a healthcare organization that paid $2 million solely to prevent publication of stolen information.
No encryption occurred, demonstrating why restoring backups cannot resolve every ransomware incident.
Generative AI also reduces the linguistic weaknesses that traditionally exposed phishing messages.
Zscaler ThreatLabz 2026 Ransomware Report, which recorded 896.2 terabytes of data exfiltrated by the top 10 ransomware groups between April 2025 and March 2026.
Attackers can produce polished emails, convincing websites, and localized impersonation material, weakening awareness strategies centered on spelling errors or awkward grammar.
AI-Powered Ransomware
Zscaler documented an initial access pattern involving email flooding followed by Microsoft Teams calls from attackers impersonating IT support.
Victims were persuaded to grant access through legitimate remote assistance tools, including Microsoft Quick Assist, AnyDesk, and TeamViewer.
In an analysis of 351 victims associated with a prominent ransomware campaign, 62% held manager positions or higher.
More than three quarters worked in finance, sales, operations, human resources, or marketing, illustrating the value of business access and organizational credibility alongside technical privileges.
AI assistance extends into tooling development. ThreatLabz observed likely AI-assisted activity involving Payouts King, where multiple functional versions of a malicious batch script appeared programmatically generated.
The attribution remains qualified: this observation does not establish that every script variant was AI-generated.
Rapid script modification can complicate signature matching, while bespoke utilities make familiar tool indicators less dependable.
However, changing code does not automatically conceal the underlying behavior, including suspicious remote access, unusual document collection, and outbound transfers.
In Payouts King incidents, ThreatLabz observed data staging and exfiltration over Secure File Transfer Protocol within hours of initial access.
Attackers deployed additional remote management tools, moved laterally through Windows features, and abused Active Directory shadow credentials for persistence before encryption.
Defensive priorities therefore extend beyond malware blocking. Organizations should restrict unauthorized remote administration, enforce narrowly scoped access, and monitor bulk downloads, unusual staging activity, and unexpected transfer destinations.
Data loss prevention and cloud access controls can interrupt unauthorized exports, while correlated identity, endpoint, and network telemetry can shorten investigation times.
AI-assisted triage can support analysts, but effective containment depends on reliable signals and enforceable controls.
The operational metric is time to exfiltration: detecting encryption alone may mean the organization has already lost control of its most sensitive information.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
——————————————————–
Click Here For The Original Source.
