StealthGuard: The Ultimate Cybersecurity Threat

An individual or group of threat actors has deployed a sophisticated ransomware attack toolkit powered by artificial intelligence (AI). This toolkit automates the discovery of Active Directory (AD) and effectively evades endpoint detection and response (EDR) solutions.

The development of this malicious tool and its payloads was supported by Cursor and Claude Opus agents throughout various stages, from initial coding to analysis and revisioning. Some agents were specifically assigned to monitor security research posts for potential bypass techniques.

Several malware samples created using this AI-driven approach were rigorously tested in virtual environments against EDR tools from industry leaders such as Sophos, CrowdStrike, and Microsoft.

Despite the AI technology involved in the research and development of this malware, it is important to note that the entire workflow is driven by human intervention.

Swift Development of EDR Evasion Techniques

Researchers at leading cybersecurity firm Sophos recently identified activity related to this toolkit on a system within a client’s network. The alerts triggered by malicious payloads stored in a specific directory indicated a focus on avoiding detection.

The malicious files included:

• Cobalt Strike profiles designed to camouflage beacon traffic as legitimate web requests
• An external command and control (C2) mechanism based on the Telegram bot API, leveraging Telegram’s infrastructure for communication
• Python-based scripts for injecting shellcode into legitimate Windows executables without disrupting their original functionality
• A Cloudflare Worker serving as a front-end redirector to obfuscate the true backend C2 server

Although the toolkit may initially resemble a “red team” post-exploitation framework, it is clear that it is being utilized in cybercriminal activities associated with ransomware.

“Our initial assessment led us to consider the involvement of a legitimate Red Team, but further investigation uncovered artifacts indicative of malicious and criminal intent,” stated Sophos to BleepingComputer.

Upon examining Cobalt Strike operator logs, researchers discovered references to a ransom note and information about multiple organizations listed on a ransomware data leak site, confirming the malicious nature of the framework and its association with cybercrime operations.

AI-Powered Malware Development

In a recent report, Sophos revealed that various Python scripts found on the compromised host were written in Russian and generated with the assistance of AI tools.

During their investigation, the researchers came across a Git repository containing components related to an automated Active Directory (AD) discovery panel and a testing lab that employed an iterative approach to developing and evaluating malware against EDR agents from Sophos, CrowdStrike, and Windows Defender.

The AD discovery process involves collecting data from completed tasks to determine the next course of action. This task is then delegated to remote agents, and the results are analyzed and refined accordingly.

The malicious framework comprises multiple AI agents, each assigned specific roles such as R&D coordination, testing, OPSEC hardening, documentation, proxy stress testing, and VM deployment.

During the development phase, some agents were responsible for documenting bypass techniques sourced from reputable cybersecurity firms like Kaspersky, Palo Alto Networks, Bishop Fox, and SpecterOps, as well as information shared in social media posts.

These agents extracted the techniques, aligned them with the MITRE ATT&CK framework, conducted testing in a controlled environment, and reported the outcomes.

The core component of the malicious framework is a Python tool that generates payloads, predominantly in Rust and Go, based on evasion techniques. Over 70 techniques were tested using close to 80 modules.

Although the initial testing indicated a high failure rate, subsequent iterations of the modules demonstrated their capability to bypass the majority of EDR solutions. However, discrepancies were noted by Sophos between the test results and the framework’s internal reporting in certain instances, though the reasons behind this are unclear.

There is no evidence to suggest that AI elements were embedded within the deployed malware or operated independently within victim environments. Instead, AI technology was leveraged to expedite the iterative process of developing, testing, and enhancing payloads to evade security products.

AI tools are playing a crucial role in reducing the gap between offensive security research findings and their practical application by threat actors.