Sophos Uncovers AI-Powered Malware Lab Designed for EDR Evasion
Sophos researchers have discovered a sophisticated threat actor leveraging AI to build a dedicated malware-testing framework aimed at evading endpoint detection and response (EDR) systems.
Sophos has uncovered a sophisticated threat actor who has developed an advanced malware-testing framework, significantly enhanced by artificial intelligence, specifically designed to bypass endpoint detection and response (EDR) security measures. The investigation was initiated after anomalous alerts on a customer's endpoint flagged malicious payloads originating from a directory used for testing, revealing a comprehensive system for refining evasion techniques.
The discovered environment was equipped with several key components for sophisticated attacks. This included custom Cobalt Strike profiles engineered to disguise command-and-control beacon traffic as legitimate web requests, a Telegram-based system for managing command and control, tools for shellcode injection, and a Cloudflare Worker to obscure the backend infrastructure. Sophos has linked this activity to ongoing ransomware deployment and data theft operations, though the specific threat group remains undisclosed due to active investigations.
Researchers identified multiple Python scripts, many written in Russian, that exhibited signs of AI generation. A crucial element was a Git repository containing an automated Active Directory discovery panel and a dedicated malware-testing lab. This lab was configured to evaluate payloads against leading EDR solutions from Sophos, CrowdStrike, and Microsoft Defender, demonstrating a direct effort to counter major security vendors.
The Active Directory discovery component was designed to collect information from completed tasks, select subsequent actions based on predefined workflows, dispatch commands to remote agents, and process returned results. While this automation mimicked AI-driven behavior, it did not involve a fully autonomous reasoning large language model (LLM). The threat actor appears to have sourced potential bypass techniques from publicly available research blogs and social media platforms like X and Telegram.
The dedicated testing lab comprised several Windows Server 2022 virtual machines, each configured for specific testing purposes. One machine was dedicated to testing against Sophos EDR, another against CrowdStrike, and a third served as a control environment without any EDR software. A separate Ubuntu virtual machine hosted a Sliver command-and-control server, illustrating a robust and multi-faceted testing infrastructure.
Multiple AI agents were integrated into the framework, coordinated by a Claude Opus 4.5 agent responsible for managing activity and setting operational rules. Other specialized agents handled tasks such as EDR testing, documentation generation, operational security (OPSEC) hardening, proxy stress testing, and virtual machine deployment. The entire setup utilized the Model Context Protocol (MCP), an open standard enabling AI assistants to interact with external tools and data sources, including Git repositories.
The threat actor employed Ludus, a platform for rapid deployment and management of virtualized security testing environments, to provision the lab infrastructure. They also used Cursor, an AI-native integrated development environment, during the malware development process. The AI agents were tasked with analyzing security research, extracting attack techniques, mapping them to the MITRE ATT&CK framework, preparing test environments, executing experiments, and reporting findings. Sophos noted that the threat actor framed this project as a red-teaming framework when interacting with Claude, a tactic observed in other attacks aimed at bypassing AI safeguards.
Despite the advanced AI integration and sophisticated evasion techniques, Sophos emphasizes that fundamental defensive practices remain critical. These include consistent patching, multi-factor authentication (MFA), the adoption of passkeys, and robust endpoint protection solutions. The findings highlight a growing trend of threat actors leveraging AI to accelerate and enhance their offensive capabilities, necessitating continuous adaptation in cybersecurity defenses.
This new report from Infosecurity Magazine details how a threat actor specifically utilized AI coding tools to generate and test malware designed to bypass Endpoint Detection and Response (EDR) solutions. The actor's process involved using AI to rapidly create code for various evasion techniques, significantly accelerating the development lifecycle of their malicious tools.