Cyberattackers have been utilizing AI-generated ransomware attack toolkits. These AI-powered toolkits can automate Active Directory discovery and help circumvent detection by endpoint detection and response (EDR) solutions.
AI-driven tool development
Various aspects of development, including the initial writing, review and revisions of code were facilitated by the use of Cursor and Claude Opus agents. In addition to these services, some agents also reviewed security-related posts on blogs to assist with identifying various bypass methods.
Testing the malware created through this process
Malware developed in this manner was then tested in simulated environments against EDR tools from companies such as Microsoft, CrowdStrike, and Sophos.
Human-controlled workflow
Although researchers believe that the malware development and research associated with the AI technology is human-controlled, they noted that there was rapid development of bypasses for EDR.
Development of rapid EDR bypass techniques
Sophos researchers discovered the activity associated with the toolkit at a customer environment where the activity caused alerts when payloads were stored in C:UsersUserDocuments est.
This suggests that the files were likely a portion of an attack framework that is attempting to evade detection:
- Designed Cobalt Strike profiles to cause beacon traffic to be similar to normal web requests
- Utilized a Telegram bot API-based external C2 method for sending commands via Telegram's network instead of directly connecting
- Used Python-based scripts for creating malware that inserts shellcode into legitimate Windows executable programs while maintaining the original program functionality
- Cloudflare Workers utilized as frontend redirectors for concealing the actual backend C2 server
Researchers stated that despite the tool appearing like a "Red Team" post-exploitation framework, it is used within cybercrime activities relating to ransomware.
"Initially we assessed it could potentially be a Red Team engaged in testing. Our investigation produced additional evidence indicating that the activity was malicious/criminal," said Sophos to Unsurfaced.com.
Entries in Cobalt Strike operator logs referencing a ransom note, along with multiple organisations referenced on a ransomware data leak site, confirmed that the framework was used for cybercrime operations.
Automated malware development using agent-based tools
In a report issued today, Sophos stated that multiple Python scripts on the compromised host were written in Russian and had been generated through AI-based tools.
During their investigation, researchers identified a Git repository containing elements associated with "an automated Active Directory discovery panel" and "a lab utilising an iterative approach to develop and test malware against Sophos, CrowdStrike, and Windows Defender endpoint detection and response agents."
Researchers stated that AD discovery is accomplished through gathering observations from previously completed tasks and using those observations to select the next action from a predetermined list of possible actions. Once selected, the task is assigned to one of many remote agents and, once complete, the results are re-evaluated.
The framework utilises multiple AI-based agents with separate roles and functions. For example, a Claude Opus 4.5 agent serves as the project manager coordinating the R&D process, while other agents perform tasks involving testing, OPSEC hardening, documentation, proxy stress testing, VM deployment, and more.
Agents responsible for documentation of bypass techniques
During the development phase, some agents documented bypass techniques as they were described in research from Kaspersky, Palo Alto Networks, Bishop Fox, SpecterOps and social media posts.
These agents extracted information describing the techniques, mapped them to the MITRE ATT&CK knowledge base describing adversary behaviours, determined what was necessary to reproduce the technique, established a test lab environment, performed the technique and provided feedback on the results.
Principal component in malicious framework: payload generator
The primary component in the malicious framework is a Python-based tool responsible for generating payloads primarily written in Rust and Go, based upon an evasion technique. Approximately 80 different modules were generated and tested against over 70 different techniques.
"This modular Windows payload loader generator encapsulates payloads in multiple layers of encryption and evasion/alternative execution techniques, producing custom-built executables/DLLs resistant to sandboxing/antivirus/EDR detection." - Sophos.
Although agents indicated that success rates would be low during development phases, nearly all EDR solutions were successfully bypassed after a few rounds of iteration. However, Sophos researchers noted anomalies between the test results and the framework's internal reporting in some cases, though they did not explain why.
No evidence that embedded AI was present within deployed malware
Sophos researchers found no indication that embedded AI existed in deployed malware nor that it was functioning independently in victim systems' environments. Instead, researchers found that AI-based technologies were accelerating an iterative cycle of developing, testing and refining payloads against security products.
AI accelerating time between security research publication and implementation by threat actors
AI-based technologies are rapidly reducing time intervals between offensive security research publications and threat actors implementing them as practical methodologies within their respective attacks.
