Attackers Use AI to Automate EDR Evasion Testing

Sophos X-Ops detected an attacker using AI-assisted development and an automated EDR-evasion lab: multiple Python scripts (some AI-generated), an Active Directory orchestration panel, and virtual machines configured to test malware against Sophos, CrowdStrike, and Windows Defender. The actor used LLM-powered tools to coordinate and automate testing and operational security, iteratively refining payloads to bypass EDRs; Sophos links the activity to ransomware deployment and data-theft operations and recommends standard mitigations such as patching, MFA, and broad EDR deployment.