Sophos found a ransomware crew using AI coding agents to build EDR-evasion malware and automate Active Directory attacks. The tooling works. The AI's claims about beating EDR were hallucinated.

AI RAISED THE FLOOR, NOT THE CEILING

The reaction to AI in attacker hands tends to skip straight to the ceiling: autonomous malware, machine-speed intrusions, defenders hopelessly outpaced. This case is a good moment to talk about the floor instead, because that is what actually moved. AI did not invent a new attack here. Cobalt Strike, Sliver, shellcode injection, and Active Directory reconnaissance are the standard furniture of post-exploitation, and they predate the current wave of coding agents by years. What changed is the cost of assembling them competently. A human directed AI agents to write the boilerplate, ingest published research, map techniques to MITRE ATT&CK, and produce the documentation. The grunt work got cheaper and faster.

That is not nothing, but it is a different problem than the one the headlines describe. A lower floor means more people can produce working tooling, and they can iterate on it faster. It means the volume of competent-looking attacks goes up and the time between a published technique and its reuse goes down. It does not mean the attacks got fundamentally smarter, or that the things that stop them stopped working. The ceiling, a genuinely novel capability that defenders have no answer for, did not move in this campaign. The floor did.

For a defender, that distinction changes the response. You do not need a new category of AI defense. You need your existing controls to actually work, and you need your detection feedback loop to be fast enough to keep up with adversaries who now iterate at the speed of a coding assistant. The fundamentals did not get less relevant. They got more.

WHAT SOPHOS ACTUALLY FOUND

The investigation started the way good detections usually surface things, with an anomaly. An endpoint in a Sophos customer environment triggered alerts tied to malicious payloads sitting in a testing directory, C:\Users\User\Documents\test. Pulling that thread led researchers to a structured post-exploitation framework built for stealthy operation and persistence.

The components are familiar to anyone who runs or defends against red teams. Customized Cobalt Strike profiles tuned to make beacon traffic look like ordinary web requests. A Sliver command-and-control server running on a separate Ubuntu host. Python scripts that inject shellcode into legitimate Windows executables while preserving their normal behavior. A Telegram bot used as a covert C2 channel, and a Cloudflare Worker acting as a redirector to hide the real backend. The test environment itself was built with Ludus, spinning up multiple Windows Server 2022 machines to evaluate evasion against different EDR agents, including products from Sophos, CrowdStrike, and Microsoft. Many of the partially AI-generated Python scripts were written in Russian, sitting alongside a Git repository holding a broader automation framework.

The AI did not run the operation. Development was coordinated through the Cursor IDE with several AI agents, including Claude models, each given a role: writing malware, testing evasion, hardening operational security, and generating documentation. Some agents were pointed at public research from groups like SpecterOps, Palo Alto Networks, and Kaspersky, told to extract techniques, map them to MITRE ATT&CK, and reproduce them in the lab. Even the Active Directory discovery, the part most likely to be sold as autonomous, was a scripted decision tree: run a task, collect the result, pick a predefined next step, dispatch it. Semi-automated, predictable, and entirely under human direction.

Sophos declined to name the group, citing an active investigation into an actor it says is currently affecting organizations worldwide, including in the United States. Their write-up is worth reading in full.

THE PART THE HEADLINES MISSED

Here is the detail that should change how you read this story. The framework's internal logs and documentation claimed high success rates at bypassing EDR. Sophos checked, and the documented output did not back up the claim. In plain terms, the AI inflated its own results. The tooling was real, but the scoreboard it kept on itself was partly fiction, the same confident wrongness anyone who has used these agents on real work has watched them produce.

That matters for two reasons, and they point in opposite directions from the usual panic. First, for defenders: do not take "AI-built malware that defeats EDR" at face value, because the claim partly came from the malware's own AI, and it was wrong. The threat is real but it is not magic, and treating it as unstoppable leads to the wrong investments. Second, for anyone building with these tools, attacker or defender: AI-generated security work carries AI's failure mode, which is to assert success it did not achieve. The attacker in this case could not fully trust their own toolkit's reporting. Neither can a defense team that wires an agent into its pipeline and believes the summary instead of checking the evidence. The lesson that survives this story is old and unglamorous: validate against reality, do not trust the self-report.

WHAT AI CHANGED, AND WHAT IT DIDN'T

It helps to separate the two cleanly, because the gap between them is where the right response lives.

THE TOOLS ARE DUAL-USE. THE LINE IS AUTHORIZATION.

We will be direct about something, because pretending otherwise would be dishonest. The agents in this story are the same ones legitimate security teams use every day, including ours. We use AI coding assistants to accelerate sanctioned offensive work: drafting tooling, parsing research, mapping findings to ATT&CK, writing up engagements. The capability described in the Sophos report is not exotic to us, and it should not be mystified for anyone else. A coding agent is a power tool. It does not know or care whether the person holding it has a signed authorization or a ransomware affiliate ID.

That is exactly why "the attackers have AI now" is the wrong frame to panic about. The attackers have the same tools the defenders have, which means the advantage does not come from access to the tool. It comes from skill, from authorization, and from the discipline to validate what the tool produces rather than trusting its confident summary. The criminal in this case had the tool and still shipped a framework whose self-reported success was fiction. The differentiator was never the model. It was the operator, and whether anyone checked the work. The practical consequence is that the premium on judgment goes up, not down. When anyone can generate plausible tooling in an afternoon, the scarce skill becomes telling what actually works from what merely looks like it works, and that is true on both sides of the engagement.

DETECTION AND HUNTING

The good news in the Sophos findings is that the output is detectable, because it is built from known parts. AI helped assemble the framework faster, but it did not produce a novel evasion that defeats the category of detection. You are hunting for the same artifacts you always were: Cobalt Strike and Sliver beacons, shellcode injection into legitimate processes, and C2 hidden behind consumer services. Start here and tune.

 title: Post-exploitation staging and covert C2 indicators 
 # Familiar tradecraft, assembled with AI help. Hunt the artifacts, not the author. 
logsource:
  product: windows
detection:
  staging_dir:
    Image|contains: '\Users\'
    Image|endswith: '\Documents\test\'    # observed payload staging path 
  injection:
    EventID: 8                                 # Sysmon CreateRemoteThread 
    TargetImage|endswith:
      - '\explorer.exe'
      - '\rundll32.exe'
      - '\svchost.exe'
  covert_c2:
    DestinationHostname|contains:
      - 'api.telegram.org'                     # Telegram-bot C2 
      - 'workers.dev'                          # Cloudflare Worker redirector 
  condition: staging_dir or injection or covert_c2
level: high

The rule above flags the building blocks. The signals below are the behaviors that AI speed does not hide, because they are generated across the network and identity layers rather than on the box the attacker controls.

WHAT TO DO TODAY

INDICATORS AND REFERENCE