Unit 42 highlights cyberespionage, extortion and AI use in November threat report

Unit 42 published its November 2026 threat intelligence highlights on Nov. 2, 2026, naming cyberespionage, financially motivated extortion and the offensive use of artificial intelligence as the three key trends in current adversary activity.

Unit 42 describes state-sponsored and advanced persistent threat (APT) actors as operators that covertly acquire strategic intelligence, intellectual property and geopolitical data through stealthy methods built to sustain long-term operations. These groups evade endpoint defenses by relying on living-off-the-land binaries and built-in administration tools that blend with normal system activity. Initial access typically comes through unpatched software flaws or tailored spear-phishing e-mails aimed at specific targets, methods that open covert paths to high-value systems.

Once inside, these operations harvest passwords and shift stolen data through slow, small transfers stretched over extended periods, an approach Unit 42 says minimizes detection while extracting sensitive information over time.

Unit 42 says financially motivated criminal organizations and their associates pursue profit by stealing data, demanding ransoms and processing fraudulent transactions, commonly through multi-extortion models that pair ransomware with public-exposure threats. Initial access often comes from stolen login credentials, data leaked by credential-stealing malware and unsecured network devices, which serve as common gateways for ransomware and extortion campaigns. Business e-mail compromise and payment-diversion schemes then issue fraudulent wire transfers that move funds from legitimate transactions into accounts the attackers control.

According to Unit 42, attackers weave generative AI and large language models (LLMs) into offensive operations of every kind, using them for social engineering, scripting and reconnaissance across espionage and financially motivated campaigns alike. Generative AI produces text and other content, while LLMs generate and manipulate language.

AI-generated social-engineering lures and synthetic personas deceive targets at scale, with messages highly tailored to specific contexts to increase success rates by focusing on particular people and scenarios. Synthetic personas fabricate identities meant to appear credible to those targets.

LLMs speed up malicious-tool development by assisting with rapid scripting, payload debugging and code obfuscation, accelerating how quickly malicious tools are built and deployed. Automated reconnaissance and multimodal tools such as deepfakes – synthetic audio or video – support executive impersonation and access operations aimed at high-value individuals.

Palo Alto Networks chief executive Nikesh Arora warned that AI cuts the span between flaw identification and attack from weeks to minutes. He said the compression of that timeline makes faster detection and response more urgent. The company’s shares gained 14% during the week through Oct. 29, 2026, a rally tied to AI-driven security advances and stronger security budgets.

Amazon launched AWS Continuum, an autonomous defense tool, on Oct. 23, 2026. It goes up against Palo Alto Networks’ AI-driven security products.

On Sept. 22, 2026, Palo Alto Networks introduced Unit 42 Continuous Frontier AI Defense, an agentic offensive security service aimed at enterprises. The service pairs an in-house multimodel harness with threat intelligence and offensive-security expertise. It draws on AI models including Claude Mythos 5 from Anthropic and GPT-5.6-Cyber from OpenAI.

Palo Alto Networks invested $17 million in developing the service, which underwent six months of internal testing and more than 100 customer engagements. It runs baseline scans and continuous testing across web applications, APIs, cloud infrastructure and network assets. Palo Alto Networks sells the offering worldwide through annual subscriptions.

Palo Alto Networks said on Aug. 3, 2026 that its Unit 42 Threat Intelligence Services give customers direct access to frontline threat expertise, merging human-led analysis and AI-driven insights into tailored threat guidance. The intelligence draws on worldwide telemetry covering more than 70,000 customers plus analysis of billions of events each day, helping security teams identify emerging threats and set risk priorities.