"Our initial assessment included the possibility that a legitimate Red Team was engaged, but our investigation revealed further artifacts that indicated malicious and criminal activity," Sophos told BleepingComputer.
Sophos detection in a customer environment
Researchers at Sophos discovered the toolkit after it triggered alerts for payloads stored in C:\Users\User\Documents\test on a customer system. Investigation of Cobalt Strike operator logs revealed entries that pointed to a ransom note and references to multiple organizations listed on a ransomware data leak site, clarifying the framework’s criminal use. Sophos also located a Git repository on the compromised host containing components tied to an automated Active Directory discovery panel and a lab designed to iteratively develop and test malware against EDR agents.
AI agents: Claude Opus 4.5, Cursor, and the human-directed workflow
Sophos reports that the malware research and development effort was orchestrated using multiple AI agents and that the overall workflow remained human-driven. A Claude Opus 4.5 agent acted as the coordinator of the R&D process while other agents were assigned roles such as testing, OPSEC hardening, documentation, proxy stress testing, and VM deployment. Cursor and Claude Opus agents assisted in initial coding, analysis, and revisioning; some agents were explicitly tasked with checking security research posts for bypass techniques. Sophos found no evidence that AI was embedded in deployed malware or operating independently in victim environments—rather, the tools accelerated iteration and refinement under human direction.
EDR bypass techniques, testing, and mixed reporting
The toolkit’s artifacts indicate a focused effort to evade detection. Researchers found Cobalt Strike profiles designed to make beacon traffic resemble legitimate web requests, a Telegram bot API–based external command-and-control mechanism that routed communication through Telegram infrastructure, Python-based scripts for injecting shellcode into legitimate Windows executables while preserving original functionality, and a Cloudflare Worker used as a front-end redirector to obscure the backend C2 server.
Sophos observed that the development process included generating and testing close to 80 modules against more than 70 techniques. The agents documented bypass techniques from published research by Kaspersky, Palo Alto Networks, Bishop Fox, and SpecterOps and from social media posts; they mapped those techniques to the MITRE ATT&CK knowledge base, identified reproduction requirements, prepared a test lab, executed the technique, and reported outcomes. Initially, agents reported a high failure rate, but after multiple iterations many modules appeared to bypass almost all EDR solutions. Sophos did note discrepancies between test output and the framework’s internal reporting in some instances, and the reasons for those inconsistencies were unclear.
Automated Active Directory discovery and payload generation
The compromised Git repository included an automated Active Directory discovery panel and an iterative lab workflow. Sophos describes the AD discovery process as observation-driven: completed task outputs were collected, the next action was selected from predefined choices, and subsequent steps were delegated to remote agents whose results were reassessed. The framework’s central component is a Python tool that generates payloads—primarily in Rust and Go—based on an evasion technique, producing a broad set of modules for automated testing against EDR products such as Sophos, CrowdStrike, and Microsoft Windows Defender.
What this means for security teams, policymakers, and affected enterprises
- Security teams: Watch for evidence of toolchains that combine automated AD reconnaissance with iterative payload generation. The artifacts Sophos found—Cobalt Strike profiles, Telegram-based C2, shellcode injection scripts, and Cloudflare fronting—are specific indicators teams can hunt for in telemetry and endpoint file systems.
- Policymakers and regulators: The report shows AI tools can materially shorten the time between public research on offensive techniques and their practical implementation by criminal actors. That acceleration may affect timelines for disclosure, vendor mitigation responsibilities, and the prioritization of defensive controls.
- Affected enterprises and procurement leaders: The framework’s use of generated Rust and Go payloads and automated AD reconnaissance highlights the importance of validating that controls block lateral-movement techniques and testing detection rules against iterative, adversary-like tooling rather than only functional penetration tests.
Sophos’ findings paint a clear picture: AI-assisted agents can compress research, test and iterate faster than traditional manual workflows, but the deployment and operational control remained with human actors. The investigation also leaves a pointed technical question open — why did the framework’s internal reporting sometimes diverge from observed test outputs — and that discrepancy matters because it speaks to how reliably such toolchains self-validate before operational use.
Read the original Sophos-based coverage at Bleeping Computer: https://www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/
