Pointing a Cursor at evading detection

**Executive Summary:** Sophos X-Ops uncovered a threat actor using AI-assisted development and orchestration to build a red‑team style post‑exploitation testing framework that produced modular loaders, Cobalt Strike profiles, Telegram-based C2, and other tooling designed to evade EDRs; the framework was used to iterate techniques against Sophos, CrowdStrike, and Windows Defender and is linked to ransomware and data theft operations.