Zscaler Report: GenAI Accelerates Ransomware Attacks and Data Theft
Zscaler ThreatLabz says generative AI helps ransomware groups create better phishing lures and locate sensitive data faster after gaining access.
Key points
- Generative AI enables attackers to create polished, native-language phishing materials that bypass traditional detection cues.
- After initial access, GenAI allows threat actors to rapidly search and classify data for encryption or theft.
- Defenders can leverage similar AI technologies to detect and mitigate these accelerated attack workflows.
Zscaler ThreatLabz published research indicating that generative AI is significantly speeding up ransomware operations. The analysis, part of the 2026 Ransomware Report, details how adversaries use these tools to improve social engineering and accelerate post-breach activities.
The report states that ransomware remains a primary driver of cybercrime financial gains. Attackers typically rely on social engineering for initial compromise. Generative AI helps them overcome historical shortcomings in creating believable pretexts, increasing the likelihood of successful infiltration into target environments.
Improved Social Engineering Tactics
Historically, many ransomware actors relied on volume rather than precision for initial access. Their social engineering efforts often contained obvious flaws, such as typos or non-native grammar mistakes. User education campaigns focused on spotting these weaknesses in phishing emails and websites.
According to Zscaler, AI has leveled the playing field by enabling attackers to blend into legitimate email traffic. Threat actors now use public-facing GenAI platforms to create polished assets. These materials are crafted in the target’s native language and designed to maximize the chance of a victim clicking a link or downloading a file.
The research notes that phishing emails are frequently used to trick users into employing Remote Monitoring and Management tools at the attacker’s request. This grants the adversary full access to the victim’s system and potentially the wider environment, establishing a foothold for further exploitation.
Accelerated Data Discovery and Theft
Time is critical after an attacker gains an initial foothold. The faster they can move through the environment and acquire sensitive data, the less likely they are to be detected. Zscaler explains that GenAI provides a faster and more focused approach to this phase of the attack.
Generative AI technologies are well-suited for examining massive amounts of data for classification or content searching. Once inside a system, attackers can use GenAI to search all accessible materials. This allows them to quickly identify the most valuable or sensitive data for theft or encryption.
This rapid identification method maximizes the likelihood that the victim’s organization will pay a ransom. By acquiring the most damaging data quickly, attackers increase the pressure on the target to retrieve or prevent the disclosure of encrypted or stolen information.
What should you do?
Defenders can leverage AI-enabled technology to stay in step with attackers. Zscaler suggests that using similar AI tools helps neutralize the adversary’s advantage. This approach allows security teams to keep pace with or get ahead of the malicious uses of these nascent technologies.
Background: Generative AI
Generative AI examples include text completion, image synthesis and code generation. These systems predict the next likely token based on vast training datasets. Understanding the underlying mechanics helps you identify risks like data leakage and hallucination in your infrastructure.
Read the full guide: Generative AI Examples: Mechanisms, Risks and Control
What to do and how to stay safe: Zscaler
- Deploy AI-enabled security tools to detect sophisticated social engineering attempts that bypass traditional grammar and typo checks.
- Monitor for unauthorized use of Remote Monitoring and Management tools, which may indicate a compromised user account.
- Implement strict data access controls to limit the scope of data an attacker can search if they gain initial access.
- Train staff to recognize phishing attempts that appear polished and native, as AI can eliminate traditional linguistic red flags.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does generative AI help ransomware attackers?
GenAI helps attackers create more believable social engineering pretexts and rapidly search for sensitive data after gaining access.
What specific tool do attackers use to gain full access after phishing?
Attackers often trick users into using Remote Monitoring and Management tools to gain full system access.
Can defenders use AI against these attacks?
Yes, defenders can use AI-enabled technology to detect and mitigate these efforts, neutralizing the adversary’s advantage.
