A sophisticated threat actor leveraging artificial intelligence technologies to automate Active Directory (AD) reconnaissance and systematically bypass endpoint detection and response (EDR) evasion techniques.
The activity was first flagged when an anomalous endpoint registered within a customer tenant generated alerts for payloads originating from C:\Users\User\Documents\test.
Investigation of that directory revealed a comprehensive post-exploitation framework built around AI-assisted tooling and iterative evasion testing.
Analysts identified multiple malicious components within the attacker’s environment, including Cobalt Strike profiles configured to blend beacon traffic with legitimate web requests.
Hackers Use AI-Generated Tools
In addition, telegram bot API-based C2 routing communications through Telegram’s infrastructure to avoid direct connections, and Python shellcode injection scripts designed to embed malicious code into legitimate Windows executables while preserving their original functionality.
A Cloudflare Worker redirector was also deployed to mask the backend C2 server’s actual infrastructure. Many of the Python scripts found on the device were written in Russian and partially AI-generated, indicating likely attribution to a Russian-speaking threat actor.
A deeper investigation uncovered a Git repository containing two primary framework components: an automated AD discovery panel and a malware development lab for iterative EDR-bypass testing.
The AD discovery panel closely resembles AI-driven automation that collects task observations, selects the next action from a predefined set of branches, dispatches work to remote agents, and re-evaluates the results.
Importantly, Sophos clarifies that this is not an autonomously reasoning large language model (LLM), but rather a structured, rule-based orchestration system.
The threat actor provisioned their environment using Ludus, a virtual machine management platform, and developed tools using Cursor, an AI-native IDE.
The lab ran multiple Windows Server 2022 VMs, one each for testing against Sophos and CrowdStrike agents, a control VM without EDR, and a fourth Ubuntu VM running a Sliver C2 server.
At the core of the framework was an AI agent orchestration playbook using Claude Opus 4.5 as the primary agent for core operations.
Additional agents handled EDR bypass testing, OPSEC hardening, documentation, proxy stress testing, and VM deployment. All code commits were pushed to Git via Model Context Protocol (MCP).
The AI agents were tasked with ingesting research from security blogs published by Kaspersky, Palo Alto Networks, Bishop Fox, and SpecterOps, then mapping extracted techniques to MITRE ATT&CK and reproducing them in the lab.
A Python-based modular payload loader generator produced custom executables and DLLs primarily written in Rust and Go, wrapped in layers of encryption, sandbox evasion, and alternative execution techniques.
Nearly 80 modules testing over 70 techniques were developed. Initial results showed high failure rates, but after iterative refinement, agents reported near-universal success in EDR bypass.
However, Sophos notes that the documented output does not fully corroborate this claim. Sophos CTU researchers have linked this development activity to known ransomware deployment and data theft operations.
Mitigation
Sophos CTU researchers emphasize that while AI lowers the barrier for sophisticated attacks, core defensive principles remain unchanged.
Organizations should deploy and maintain robust, up-to-date EDR solutions across all endpoints, enforce multi-factor authentication (MFA) alongside modern mechanisms such as passkeys, and apply timely patches to close gaps that AI agents are increasingly able to identify.
Maintaining a strong defense-in-depth posture across the entire control framework remains the most reliable safeguard against this evolving class of AI-accelerated threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 reconnaissance and systematically bypass endpoint detection and response (EDR) solutions from Sophos, CrowdStrike, and Microsoft Defender.){kind=link}