Sophos Details AI-Assisted Toolkit for Ransomware EDR Evasion
Summary
Sophos says a human-driven toolkit used Cursor and Claude Opus to automate Active Directory discovery and iteratively develop payloads tested against major EDR products. Researchers linked the framework to ransomware-related cybercrime.
Key points
- Sophos detected toolkit activity on a customer system; its investigation linked the framework to ransomware-related cybercrime, including through Cobalt Strike logs referencing a ransom note and organizations listed on a leak site.
- The toolkit automates Active Directory discovery by collecting task results and selecting subsequent actions.
- AI tools including Cursor and Claude Opus assisted with coding, analysis, testing, and revision; Sophos found no evidence that AI was embedded in deployed malware or operating independently in victim environments.
- The framework included Cobalt Strike profiles, Telegram-based command and control, Python injectors, and a Cloudflare Worker redirector.
- A Python tool generated modular Windows payloads, mostly in Rust and Go; Sophos reported nearly 80 modules tested against more than 70 techniques.
- Sophos said some modules appeared to bypass almost all tested EDR solutions after iterations, but noted discrepancies between test outputs and the framework's internal reporting.
Article Details
- Attack Vectors
- Automated Active Directory discovery that selects subsequent actions based on observations from completed tasks.
- Custom payloads generated in Rust and Go to evade sandboxing, antivirus, and EDR detection.
- Python scripts that inject shellcode into legitimate Windows executables while preserving their original functionality.
- A Telegram bot API-based command-and-control mechanism that routes communications through Telegram's infrastructure.
- A Cloudflare Worker used as a front-end redirector to obscure the backend C2 server.
- Cobalt Strike profiles designed to make beacon traffic resemble legitimate web requests.
MITRE ATT&CK
T1055 · Process InjectionPython-based malware development scripts inject shellcode into legitimate Windows executables while preserving their functionality.T1090 · ProxyA Cloudflare Worker acts as a front-end redirector to obscure the actual backend C2 server.T1102 · Web ServiceThe toolkit uses a Telegram bot API-based C2 mechanism routed through Telegram's infrastructure.
Vendors
CrowdStrikeA threat actor is using an AI-assisted ransomware toolkit to automate Active Directory discovery and rapidly develop EDR-bypass payloads tested against Sophos, CrowdStrike, and Microsoft defenses.MicrosoftA threat actor is using an AI-assisted ransomware toolkit to automate Active Directory discovery and rapidly develop EDR-bypass payloads tested against Sophos, CrowdStrike, and Microsoft defenses.SophosA threat actor is using an AI-assisted ransomware toolkit to automate Active Directory discovery and rapidly develop EDR-bypass payloads tested against Sophos, CrowdStrike, and Microsoft defenses.
Products
Tools
Claude Opus 4.5For instance, a Claude Opus 4.5 agent acts as the coordinator of the R&D process, while others handle testing, OPSEC hardening, documentation, proxy stress testing, VM deployment, and other related tasks.Cobalt StrikeSophos found the operation was human-driven but heavily accelerated by Cursor and Claude Opus, with modular loaders, Cobalt Strike profiles, and other components built to evade detection.CursorSophos found the operation was human-driven but heavily accelerated by Cursor and Claude Opus, with modular loaders, Cobalt Strike profiles, and other components built to evade detection.