The transition to Ethernet-based networks in high-speed EMUs introduces significant cybersecurity challenges. While global standards and research efforts address rail cybersecurity, studies on EMU-specific threats remain limited by the scarcity of real-world attack incidents and samples. This hinders the application of data-intensive deep learning methods for cybersecurity technologies, such as intrusion detection and risk assessment. To address this challenge, we propose an improved GAN-based method that integrates Wasserstein distance, gradient penalty, and auxiliary classification to generate diverse, class-specific attack samples. Referencing the system architecture of China’s CR300 EMU, a simulated experiment environment is constructed to generate real attack samples. Experimental results show that the generated samples closely resemble real attack data, effectively augmenting training datasets and posing greater challenges to intrusion detection models.