Zscaler ThreatLabz: Ransomware Groups Use Generative AI for Phishing, Data Triage and Fast Exfiltration, Including Payouts King
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual increase, but the figures do not measure how much of the theft was AI-assisted. Extortion is shifting toward data-theft-only attacks: Zscaler described a healthcare organization that paid $2 million to prevent publication of stolen data, with no encryption involved. The article stresses that time to exfiltration, not encryption detection, is the operative defensive metric.
Technical Details
- Initial access: email flooding followed by Microsoft Teams calls from attackers impersonating IT support. Victims were persuaded to grant access through Microsoft Quick Assist, AnyDesk and TeamViewer.
- Targeting: in an analysis of 351 victims tied to a prominent ransomware campaign, 62% held manager positions or higher. More than three quarters worked in finance, sales, operations, HR or marketing.
- AI use: generative AI is used to produce polished phishing emails, websites and localized impersonation material. After compromise it classifies accessible documents to find commercially or legally sensitive data. Its reach depends on the permissions of the compromised identity.
- Payouts King: ThreatLabz observed likely AI-assisted tooling, with multiple functional versions of a malicious batch script that appeared programmatically generated. This does not prove every variant was AI-generated.
- Payouts King intrusion flow: data staging and exfiltration over SFTP within hours of initial access, deployment of additional remote management tools, lateral movement through Windows features, and persistence via Active Directory shadow credentials before encryption.
- Rapid script modification complicates signature matching, but the underlying behavior (remote access, unusual document collection, outbound transfers) remains detectable.
Remediation
- Restrict unauthorized remote administration tools and enforce narrowly scoped access, since excessive permissions amplify AI-driven data discovery.
- Monitor bulk downloads, unusual staging activity and unexpected transfer destinations.
- Use data loss prevention and cloud access controls to interrupt unauthorized exports.
- Correlate identity, endpoint and network telemetry to shorten investigation time.
- Do not rely on spelling or grammar errors in awareness training, and do not treat backup restoration as a complete answer to ransomware.
Linha do tempo
-
Zscaler ThreatLabz: Ransomware Groups Use Generative AI for Phishing, Data Triage and Fast Exfiltration, Including Payouts King
ler a análise desta fonte ocultar
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual increase, but the figures do not measure how much of the theft was AI-assisted. Extortion is shifting toward data-theft-only attacks: Zscaler described a healthcare organization that paid $2 million to prevent publication of stolen data, with no encryption involved. The article stresses that time to exfiltration, not encryption detection, is the operative defensive metric.
Technical Details
- Initial access: email flooding followed by Microsoft Teams calls from attackers impersonating IT support. Victims were persuaded to grant access through Microsoft Quick Assist, AnyDesk and TeamViewer.
- Targeting: in an analysis of 351 victims tied to a prominent ransomware campaign, 62% held manager positions or higher. More than three quarters worked in finance, sales, operations, HR or marketing.
- AI use: generative AI is used to produce polished phishing emails, websites and localized impersonation material. After compromise it classifies accessible documents to find commercially or legally sensitive data. Its reach depends on the permissions of the compromised identity.
- Payouts King: ThreatLabz observed likely AI-assisted tooling, with multiple functional versions of a malicious batch script that appeared programmatically generated. This does not prove every variant was AI-generated.
- Payouts King intrusion flow: data staging and exfiltration over SFTP within hours of initial access, deployment of additional remote management tools, lateral movement through Windows features, and persistence via Active Directory shadow credentials before encryption.
- Rapid script modification complicates signature matching, but the underlying behavior (remote access, unusual document collection, outbound transfers) remains detectable.
Remediation
- Restrict unauthorized remote administration tools and enforce narrowly scoped access, since excessive permissions amplify AI-driven data discovery.
- Monitor bulk downloads, unusual staging activity and unexpected transfer destinations.
- Use data loss prevention and cloud access controls to interrupt unauthorized exports.
- Correlate identity, endpoint and network telemetry to shorten investigation time.
- Do not rely on spelling or grammar errors in awareness training, and do not treat backup restoration as a complete answer to ransomware.