Unit 42 details espionage, cybercrime and AI enabled attacks

Unit 42 has published a threat intelligence overview for 2 November 2026, outlining a triad of ongoing adversary activity across cyberespionage, cybercrime and AI-enabled offensive operations. The report notes state-sponsored and advanced persistent threat campaigns prioritising covert strategic intelligence, intellectual property and geopolitical data, alongside multi-extortion and payment fraud schemes tied to data compromise and fraud. Across threat disciplines, there is a marked cross-cutting adoption of artificial intelligence tools.

In cyberespionage, Unit 42 reports sustained use of living-off-the-land binaries and built-in administration utilities to evade endpoint protections, with observers identifying exploitation of zero-day vulnerabilities paired with targeted spear phishing to gain initial access. The campaign model includes covert credential harvesting and long-duration data staging designed to sustain persistence.

On the cybercrime front, data theft, extortion and financial fraud are driven by multi-extortion approaches that combine data exfiltration with ransomware or public exposure threats; access is frequently facilitated by compromised credentials, leaked infostealer logs and unpatched perimeter assets, while business email compromise and fraudulent wire transfers appear among typical schemes.

Finally, AI-enabled offensive operations describe actors leveraging generative AI and large language models to craft refined social engineering lures, accelerate scripting and payload debugging, and employ automated reconnaissance and multimodal tools such as deepfakes for executive impersonation and access operations.

Unit 42 emphasises these themes as cross-cutting developments observed in recent threat intelligence bulletins. The executive summary frames these patterns as indicative of evolving attacker workflows and capabilities across multiple domains.