Back Feeds.4Sysops

Threat actor uses AI agents to automate EDR evasion and malware testing

Feeds.4Sysops •IT News • June 2, 2026

A threat actor has developed a sophisticated malware-testing framework that utilizes AI agents to automate the evasion of endpoint detection and response (EDR) software. The operation was discovered after unusual activity was detected in a testing directory on a customer endpoint, leading to the discovery of a lab environment. This setup included Windows Server 2022 virtual machines specifically configured to test malicious payloads against security products from Sophos, CrowdStrike, and Microsoft. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Malware Framework Automates EDR Evasion Tactics Sophos X-Ops analysts uncovered a threat actor utilizing AI technologies to develop a malware-testing framework aimed at evading endpoint detection and response (EDR) systems. The activity was detected on June 2, 2026, when alerts were triggered by suspicious payloads in a testing directory on a customer endpoint. The framework included multiple virtual machines running Windows Server 2022, testing against EDR solutions from Sophos, CrowdStrike, and Microsoft. The attacker employed AI tools such as Cursor and Claude Opus to automate Active Directory discovery and malware development processes. Despite the use of AI, the workflow remained human-driven, with significant reliance on human review and iteration. The investigation revealed that the malware was part of a broader cybercriminal operation, rather than a legitimate red team exercise. The malicious components were primarily Python scripts, many of which were AI-generated and written in Russian. The framework's sophistication raises concerns about the evolving capabilities of threat actors leveraging AI technologies. 13 sources 70

Threat actor uses AI agents to automate EDR evasion and malware testing

The full story

Extracted Entities

Attack Types (1)

Platforms (1)