Ransomware Groups Turn GenAI Into an Assembly Line: Average…

Zscaler's ThreatLabz 2026 Ransomware Report documents how ransomware gangs use generative AI to accelerate malware development and scripting. Average payment reaches $431,995 as the model shifts from encryption to data leverage.

Zscaler published the ThreatLabz 2026 Ransomware Report on September 30, 2026, covering the period April 2025 through March 2026. Researchers tracked the operational use of generative AI tools to accelerate malware development, reconnaissance, and script customization. The result is a structural inversion: fewer attacks, more data stolen, higher average payouts. The economic model has shifted from an "encryption tax" to a "data leverage tax."

Key Takeaways

Ransomware groups have integrated GenAI as an "accelerant" in the malware development lifecycle, not as a replacement for human operators
Data theft by the top 10 gangs surged 275.8% to 896.2 TB, while total blockchain-tracked payments fell to ~$328 million (-15.8% YoY)
Average individual payment reached $431,995 (+5.3%), with 62% of victims holding managerial or executive roles
Microsoft Teams and Quick Assist were abused as vectors for social engineering, lateral movement, and data theft

The Ransomware "Quality Over Quantity" Shift

The number of individual payments recorded dropped 20.1% year over year. At the same time, the average payment rose 5.3% to $431,995. According to cited sources, total blockchain-tracked payments stood at approximately $328 million, down 15.8% YoY. This dynamic signals a selective contraction: fewer victims, chosen with greater precision.

The key metric is data theft. The top 10 ransomware gangs exfiltrated 896.2 TB, up from 123.8 TB in the prior period — a 275.8% increase. The figure is measured via leak-site monitoring, not a global inventory of all ransomware data theft. Deepen Desai, Zscaler EVP of Cybersecurity, confirmed the strategic direction: "They are using GenAI to speed up operations, and focusing on stealing more of an organization's intellectual property, customer information, and other sensitive data to drive payment."

How GenAI Compresses the Attack Cycle

Zscaler tracked "GenAI-assisted malware development and scripting" during the reporting period. The technical description spans "AI-written obfuscation routines to chatbot-generated phishing lures." The report does not specify how many groups adopt these tools, nor which models are used — commercial, open-source, or custom. It explicitly defines them as an "accelerant layered onto an existing playbook," not substitutes for human intelligence.

The practical effect is compression of the time between initial access and data exfiltration. Attackers generate malware variants faster, customize phishing executive-to-executive, and iterate reconnaissance scripts in real time. Signature-based detection systematically lags: the signature ships when the campaign has already mutated.

Abuse of legitimate enterprise applications amplifies the problem. Microsoft Teams and Quick Assist were exploited for social engineering, lateral movement, and data theft. These tools bypass traditional perimeter controls because they appear as legitimate traffic.

The 62% Executive Targeting Rate

62% of ransomware victims held manager-level titles or above. This data point, present in both cybersecurity-insiders.com and the Zscaler IR release, indicates selective profiling that precedes technical contact. It is unclear whether this represents a novelty for the 2025-2026 period or an ongoing trend without a comparable historical baseline.

Geography remains concentrated: the United States absorbed 50.7% of observed activity. The most targeted sectors are manufacturing and technology, with percentage spikes in freight/logistics (+725%) and utilities (+622%). Zscaler did not include utilities in the formal comparison due to an initially small base; the same methodological caveat may apply to freight/logistics.

On threat landscape fragmentation, 9 of the top 15 groups by victim volume were new to the rankings. Overall, 52 new active ransomware groups were identified during the year. Total victims tracked on leak sites reached 7,366, down 3% YoY.

What to Do Now

Redesign monitoring around data exfiltration, not just encryption: the attackers' true objective has become theft of IP and sensitive data
Behaviorally profile executives and their endpoints: 62% of victims hold leadership roles, requiring targeted controls beyond generic policies
Monitor abuse of legitimate enterprise tools like Teams and Quick Assist: their traffic must be analyzed for anomalies in volume, timing, and direction
Reduce reliance on signature-based detection: GenAI iteration speed renders reactive signatures insufficient for behavioral profiling

"Successful ransomware extortion is shifting away from file encryption that often causes business disruptions to less visible, but more damaging data theft attacks" — Deepen Desai, EVP Cybersecurity, Zscaler

The Asymmetric Time Advantage

The real discontinuity is not AI autonomy, but its adoption velocity. Ransomware groups have integrated GenAI into the same phases where legitimate enterprises are experimenting with it for defense. The result is a temporal advantage: the attacker iterates in hours, the defender deploys in days. The $328 million tracked on blockchain is a Zscaler figure, not necessarily the universe of global payments. Chainalysis, using a different methodology, estimated roughly $820 million for 2025; the figures are not directly comparable.

For CISOs and boards, the traditional perimeter — backup, anti-encryption, patch management — treats the symptom, not the cause. The cause is data exfiltration as the primary lever, made more efficient by GenAI and more invisible by abuse of trusted tools. The insurance sector will need to recalibrate breach-cost risk models on an escalation from 123.8 to 896.2 TB: no longer a containable incident, but a systemic exposure.

Frequently Asked Questions

Do ransomware groups use end-to-end autonomous AI models?

No. Zscaler explicitly describes GenAI as an "accelerant layered onto an existing playbook." The human operator remains central, but operates with tools that compress development and customization time.

Does the $328 million represent all global ransomware payments?

No. It is the total of blockchain-tracked payments per Zscaler's methodology. The figure does not cover potential payments through other channels or less-monitored cryptocurrencies.

Which specific GenAI models do ransomware groups use?

The dossier does not specify. It is unknown whether they use commercial, open-source, or custom models, nor which jailbreak or model manipulation techniques they may employ.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter