State Spies, Extortion Gangs and AI: What Unit 42 Is Seeing in Current Threat Activity

Palo Alto Networks' Unit 42 has published a high-level overview of recent threat intelligence, dated 2 November 2026. It groups current adversary activity into two main areas: strategic intelligence collection and financial extortion. The overview also points to a wider adoption of artificial intelligence tools across several types of threat actor.

On the first front, state-sponsored and advanced persistent threat (APT) campaigns are focused on quietly acquiring strategic intelligence, intellectual property or geopolitical data. On the second, organised syndicates and their affiliates are seeking financial gain. Unit 42 describes this as systemic data compromise, extortion and fraudulent transactions.

The notable emerging trend is that threat actors are building generative AI and large language models (LLMs) into their offensive workflows. Unit 42 says this cuts across multiple motivations, so it is not limited to one kind of attacker.

The overview summarises longer bulletins that Unit 42 has provided to its Threat Intelligence Services customers. The portion of the article available here does not include technical details, named groups or specific incidents, so it should be read as a snapshot of the broader picture rather than a full account.