AI-Driven Malware Framework Automates EDR Evasion Tactics

Sophos X-Ops analysts uncovered a threat actor utilizing AI technologies to develop a malware-testing framework aimed at evading endpoint detection and response (EDR) systems. The activity was detected on June 2, 2026, when alerts were triggered by suspicious payloads in a testing directory on a customer endpoint. The framework included multiple virtual machines running Windows Server 2022, testing against EDR solutions from Sophos, CrowdStrike, and Microsoft. The attacker employed AI tools such as Cursor and Claude Opus to automate Active Directory discovery and malware development processes. Despite the use of AI, the workflow remained human-driven, with significant reliance on human review and iteration. The investigation revealed that the malware was part of a broader cybercriminal operation, rather than a legitimate red team exercise. The malicious components were primarily Python scripts, many of which were AI-generated and written in Russian. The framework's sophistication raises concerns about the evolving capabilities of threat actors leveraging AI technologies.

Key Points: • Sophos detected AI-driven malware development aimed at evading EDR systems. • The framework utilized multiple VMs to test against Sophos, CrowdStrike, and Microsoft EDRs. • AI tools were used to automate processes, but human oversight remained crucial.