How attackers weaponize AI faster: Trellix November 2026 CyberThreat Report

Cybersecurity has always been a race between attackers and defenders, but the speed of that race is changing. Over April through September 2026, Trellix observed threat actors operating with greater autonomy, moving faster across the attack lifecycle, and embedding artificial intelligence deeper into their operations. For CISOs and SOC leaders, the question is no longer only what is happening, but how quickly defenses can respond before an incident escalates. Softprom is the official distributor of Trellix.

What was announced

Trellix released its November 2026 CyberThreat Report, covering the April–September 2026 period. Ransomware activity reached record levels, with both the number of active groups and victim posts at all-time highs. New ransomware groups accounted for nearly a third of victim posts by August.

The Advanced Research Center also documented AI-supported extortion operations, autonomous attack chains, and new malware families targeting AI environments themselves. Geopolitical dynamics shaped detections: Iran-aligned activity rose during regional escalations, Russia continued combining cyber and gray-zone operations around Ukraine, while China-aligned patterns reminded analysts that volume changes do not equal intent changes.

Why this matters

For security leaders, the report reframes the core challenge. The hard part is no longer seeing malicious activity; it is seeing it in time. When an exploit moves from disclosure to weaponization in hours, a correlation that surfaces tomorrow is simply a well-documented breach.

The objective is not more intelligence or more alerts. It is better decisions, made faster

Anthropic's Claude Mythos Preview, introduced in April, demonstrated autonomous vulnerability discovery and working exploit development in a controlled research setting. Trellix expects the time between vulnerability discovery and real-world exploitation to keep compressing, pressuring vulnerability backlogs and traditional prioritization.

Technical details

• Reporting window: April–September 2026 telemetry and intelligence.
• Ransomware trend: record number of active groups and victim posts; new groups ~1/3 of August postings.
• AI in attacks: used across reconnaissance, social engineering, vulnerability research, and malware development.
• Geopolitical signals: Iran-aligned surge during hostilities; sustained Russia-linked activity; nuanced China-aligned patterns.
• Defender priorities: exploitation-driven vulnerability management, visibility into AI agents and orchestration, behavioral detection across the full kill chain, automation of SOC workflows.
• Operating model: unified pipelines combining threat intelligence and detection engineering for lower latency.

FAQ

What period does the November 2026 CyberThreat Report cover?

It covers April through September 2026, combining threat intelligence telemetry, ransomware tracking, and detection engineering insights from the Trellix Advanced Research Center.

How is AI changing the attack lifecycle?

AI is becoming embedded across reconnaissance, social engineering, vulnerability research, and malware creation, shortening the time between disclosure and exploitation and enabling partially autonomous attack chains.

What should CISOs prioritize now?

Prioritize exploitation-based vulnerability management, visibility into AI agents and their credentials, behavioral detection across the kill chain, and automation so defenders can operate at machine speed.

Softprom and Trellix

Softprom is the official distributor of Trellix. Our team helps enterprises deploy Trellix XDR, threat intelligence, and detection engineering capabilities aligned with the findings of the latest CyberThreat Report.

Prepared by the Softprom editorial team based on vendor materials (Softprom DistriFlow). Source: original article.