AI-Built Ransomware Toolkit Bypasses 70+ EDR Controls in Live Campaign

The AI ransomware toolkit is an automated malware development and validation pipeline, not a single executable. Sophos CTU identified a Git repository containing three core components: an Active Directory discovery panel, a modular payload generator, and a virtual machine testing lab, all coordinated by a multi-agent AI system using Claude Opus 4.5 as the primary orchestrator.

The payload generator, written in Python, produces executables in Rust and Go. Each generated payload wraps its shellcode in a different combination of encryption, obfuscation, and execution technique. One iteration might use process hollowing, another reflective DLL injection, and a third AMSI bypass via memory patching. Technique selection is not random: Claude Opus 4.5 agents actively read security research publications, extract documented bypass methods, map them to MITRE ATT&CK IDs, and queue them for testing in the automated lab environment.

Testing runs across four virtual machines: two running Windows Server 2022 (one with Sophos Intercept X, one with CrowdStrike Falcon), a control VM with no EDR for baseline comparison, and an Ubuntu machine hosting a Sliver command-and-control framework for callback testing. Each payload iteration executes in the lab. If the EDR detects it, the result returns to the AI coordinator, which selects a different technique and regenerates. Successful payloads enter the deployable module set. Nearly 80 modules testing over 70 distinct techniques resulted from this loop.

Cobalt Strike served as the primary offensive framework for live operations. The operator built custom Malleable C2 profiles that disguise beacon traffic as legitimate HTTPS requests, routing command-and-control through Telegram's bot API infrastructure with a Cloudflare Worker fronting the connection to prevent direct C2 attribution. BloodHound integrated into the toolkit handles automated Active Directory enumeration immediately after initial access, giving the operator a complete domain attack map without manual reconnaissance. This infrastructure architecture mirrors professional ransomware-as-a-service tradecraft.

Active Directory automated discovery converts initial access into domain-wide compromise faster than manual reconnaissance by any measure. BloodHound, the open-source AD enumeration tool developed by SpecterOps and widely weaponized by ransomware operators, is the core discovery component in this toolkit.

BloodHound queries Active Directory for every user account, computer, Group Policy Object, and trust relationship visible to the compromised host. It constructs a graph database showing the shortest privilege escalation path from any compromised account to Domain Admin. The AI ransomware toolkit extends this with a custom dashboard built over BloodHound output that surfaces the most actionable attack paths automatically, without requiring the operator to analyze raw graph data. Affiliates with moderate skill levels can execute expert-level AD attacks using this interface.

Kerberoasting follows immediately after AD mapping. Service accounts with Service Principal Names configured (a common legacy setting in enterprises that have grown organically over years) are targeted for Kerberos ticket extraction. Those tickets are taken offline for password cracking, yielding plaintext credentials without triggering account lockout policies. Sophos detected this activity under the ATK/Kroast detection family, with multiple variants documented. The Impacket toolkit handles lateral movement once credentials are cracked, with Sophos signatures ATK/Impacket-A through ATK/Impacket-E covering the full range of Impacket-based techniques this operator deployed.

Detection is specific and actionable. Windows Event ID 4662 (object access with read property permissions on AD attributes including msDS-AllowedToDelegateTo and adminCount) fires during BloodHound collection runs. Large bursts of LDAP queries from workstations or application servers, typically hundreds per second for several minutes, are the network signature of SharpHound data collection. Any non-domain-controller host generating this query pattern warrants immediate investigation.

The 70-plus EDR evasion techniques this toolkit tested span the full spectrum of Windows endpoint security controls: from AMSI bypass to process injection variants, from Cobalt Strike beacon profile obfuscation to LSASS credential dumping. Each technique targets a specific detection layer that EDR platforms use to identify malicious activity.

AMSI bypass ranks among the highest-priority evasion categories. AMSI is the Windows interface that security products use to inspect PowerShell, VBScript, and other scripted content at runtime. Bypassing AMSI means PowerShell-based post-exploitation tools execute without any security product visibility. The AI agents in this toolkit sourced AMSI bypass techniques from security research blogs, reproduced them in the payload generator, and iterated until they passed AMSI-enabled scanning in the test lab. Sophos detects successful AMSI bypass attempts via the AMSI/BloodH-A signature when BloodHound's PowerShell components are involved.

Cobalt Strike Malleable C2 profile generation is the network evasion layer. A Malleable C2 profile instructs a Cobalt Strike beacon how to format its HTTP and HTTPS requests so they resemble legitimate traffic. Custom profiles that mimic specific enterprise SaaS platforms, cloud storage APIs, or CDN traffic are near-impossible to block by signature without disrupting legitimate connectivity. The AI toolkit generated these profiles automatically, producing network signatures that proxy and web filtering tools will not flag without deep behavioral analysis baselines.

Credential dumping via LSASS memory access remains the most consistently targeted Windows security mechanism across all documented ransomware campaigns. ATK/SecDump-A detections indicate the operator attempted LSASS process memory reads to extract credential material for privilege escalation. Combined with Impacket-based lateral movement (ATK/Impacket-A through -E), the full post-access chain from initial foothold to domain controller completes within hours rather than days.

For context on parallel AI offensive capability development, see our earlier analysis of AI-built zero-day tooling in 2FA bypass campaigns, which documented structurally similar iterative AI development infrastructure across a different threat actor group, reinforcing that this is an emerging pattern rather than an isolated incident.

Sophos CTU's attribution evidence places this campaign firmly in the criminal ransomware ecosystem. The discovery was not theoretical: when investigators analyzed the anomalous endpoint alerts, they found Cobalt Strike operator logs containing entries that reference ransom notes and details on multiple organizations confirmed on a ransomware data leak site. The campaign was already operational, not in development, at detection time.

The threat actor profile is Russian-speaking, based on Cyrillic script analysis within the toolkit's configuration files and naming conventions consistent with Eastern European ransomware affiliate tradecraft. No specific ransomware group has been publicly named by Sophos for this campaign. The technical sophistication, including the multi-agent AI infrastructure, custom Cobalt Strike profiles, and automated AD discovery capability, places this actor above entry-level affiliate operations. Well-resourced ransomware-as-a-service affiliates or a closed criminal group with sustained cloud compute access are the most consistent attributions.

The AI development infrastructure itself creates forensic artifacts that traditional malware development does not. AI orchestration session logs, API call records, and Git repository histories leave traces that a hand-coded toolkit would not generate. Sophos found this toolkit because those artifacts were present on a customer endpoint. The threat actor used Cloudflare Workers and Telegram C2 to obscure network activity, but the development environment created the detection path.

Sectors with the highest current exposure share a common profile: legacy Active Directory environments, high concentrations of privileged service accounts, and endpoint environments where default EDR configurations have not been hardened toward behavioral detection. Financial services organizations running hybrid AD environments, healthcare providers with legacy Windows Server domain controllers, and manufacturing firms with OT-adjacent IT infrastructure represent the highest-risk profiles for this specific attack chain. The ShinyHunters SaaS extortion campaign documented parallel sector targeting of financial services and SaaS-dependent enterprises, consistent with the access patterns this toolkit enables.

Sophos CTU published detection signatures identifying the specific components of this toolkit. Organizations running other EDR platforms should translate these into behavioral equivalents on their platform. The steps below address the specific attack chain Sophos documented, ordered by impact on reducing exposure.

The Sophos CTU finding changes one core assumption defenders have relied on: that developing malware capable of bypassing enterprise-grade EDR requires rare expertise that limits the pool of capable threat actors. That assumption no longer holds after June 2, 2026.

Traditional ransomware payload development requires deep knowledge of Windows internals, EDR architecture, and software engineering. Operators who could build bypass-capable payloads from scratch numbered in the hundreds globally. The skills barrier meant that even well-funded criminal groups often depended on shared toolkits or purchased loaders, creating chokepoints where law enforcement could disrupt the supply chain. AI-orchestrated toolkit development removes that constraint. An operator with moderate technical skill and sustained cloud compute access can now build a custom, iteration-tested evasion framework in days rather than months.

The AI agent sourcing of public security research has an immediate operational implication. Every bypass technique that security researchers publish is now automatically harvested, mapped, and tested by adversary AI agents within days of publication. The gap between "researcher publishes a bypass" and "attacker deploys it operationally" has collapsed. Signature updates that vendors ship within 30 days of a bypass publication are already obsolete before they arrive in an endpoint's definition database.

Three sectors carry compounded exposure. Financial services organizations have the highest concentration of legacy service accounts with weak passwords and SPNs configured, the primary Kerberoasting targets in this toolkit. Healthcare providers typically run domain environments with minimal behavioral monitoring, where BloodHound enumeration can run undetected for extended periods. Manufacturing firms with OT-adjacent Active Directory environments often have the weakest lateral movement controls, allowing rapid spread once credentials are cracked.

Organizations that have invested primarily in signature-based defenses face structurally higher risk than those with behavioral analysis enabled. The minimum viable defensive posture against this specific threat requires three controls active simultaneously: behavioral EDR enforcement, Telegram API blocked at the perimeter, and SPN-bearing service accounts rotated. Any organization that cannot confirm all three by end of day today has an active exposure that this campaign is specifically designed to exploit.