Zscaler says ransomware gangs use AI to select data for extortion
Original title: Ransomware Gangs Use AI to Find and Steal the Most Sensitive Company Data Quickly
ThreatLabz cites 896.2 TB stolen by the top 10 groups and a healthcare payment of $2 million with no encryption.
Zscaler ThreatLabz says ransomware operators use generative AI for phishing, reconnaissance and post-compromise sorting of sensitive files, favoring disclosure pressure over encryption. Its 2026 report recorded 896.2 terabytes exfiltrated by the top 10 groups from April 2025 to March 2026, and describes a healthcare organization that paid $2 million only to stop publication. Access paths included email flooding and Microsoft Teams calls impersonating IT support, then Quick Assist, AnyDesk or TeamViewer. In Payouts King cases, data left over SFTP within hours, with extra remote tools, Windows lateral movement and Active Directory shadow credentials.
Unconfirmed: ThreatLabz says the theft figures do not show how much came from AI, and AI authorship of every Payouts King script is unproven.
- Zscaler cites a 275.8% annual increase but says the figures do not measure AI's share.
- Of 351 victims in one campaign, 62% were managers or higher.
- More than three quarters of those victims worked in finance, sales, operations, HR or marketing.
- AI involvement in Payouts King batch scripts is described as likely, not proven for every variant.
Impact: Extortion via stolen sensitive data, sometimes without encrypting files
- 1.Restrict unauthorized remote administration tools such as Quick Assist, AnyDesk and TeamViewer.
- 2.Monitor bulk downloads, staging and unexpected SFTP or other transfer destinations.
- 3.Limit access rights so a compromised identity cannot reach sensitive repositories.
- ATT&CK
- T1566 PhishingT1219 Remote Access SoftwareT1048 Exfiltration Over Alternative ProtocolT1098 Account Manipulation
- Vendors
- Microsoft
- Malware
- Payouts King
- Organizations
- Zscaler
From the original article
3 min read at gbhackers.com
Ransomware operators are using generative AI to sharpen phishing campaigns, speed up reconnaissance, and identify sensitive corporate information to steal. Zscaler ThreatLabz describes a shift toward faster, more selective extortion, where attackers prioritize damaging disclosures rather than relying exclusively on file encryption. That represents a 275.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.