AI-built ransomware toolkit automates EDR evasion, AD discovery

https://www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/amp/

Publish Date: 2026-06-02 16:01:00

A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions.

Tool and payload development was assisted by Cursor and Claude Opus agents in various stages, including initial coding, analysis, and revisioning. Additionally, some agents were tasked with checking security research posts for various bypass techniques.

Some of the malware created this way was tested in virtual environments against EDR tools from Sophos, CrowdStrike, and Microsoft.

Despite the malware research and development orchestrated using AI technology, the researchers note that the workflow is entirely human-driven.

Rapid EDR-bypass development

Researchers at cybersecurity company Sophos detected activity from the toolkit on a system at a customer environment that triggered alerts for payloads stored in C:UsersUserDocumentstest.

The malicious files suggested they were part of an attack framework that focused on evading detection:

Cobalt Strike profiles designed to make beacon traffic resemble legitimate web requests
A Telegram bot API–based external command and control (C2) mechanism that routed communication through Telegram’s infrastructure rather than using direct connections
Python-based malware development scripts for injecting shellcode into legitimate Windows executables while preserving original functionality
A Cloudflare Worker acting as a front-end redirector to obscure the actual backend C2 server

The researchers say that while the tool may appear as a “red team” post-exploitation framework, it is used in cybercriminal activity related to ransomware.

“Our initial assessment included the possibility that a legitimate Red Team was engaged, but our investigation revealed further artifacts that indicated malicious and criminal activity,” Sophos told BleepingComputer.

The discovery in Cobalt Strike operator logs of entries pointing to a…

Source