{"schema_version":"0.10.0","id":"LR-2026-0595","record_version":1,"title":"AI-built ransomware toolkit automates EDR evasion and AD discovery","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: BleepingComputer · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: BleepingComputer · subject to change"}]},"sources_hash":"b5e0a201afc964fb41d1403c5290c66906a85bc8aca65aaaab9bd9661f50fcbe"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-02","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A threat actor's toolkit, built with AI coding agents, automates Active Directory discovery and helps evade endpoint detection and response (EDR) products. Agents coordinated development, testing and reporting of evasion techniques, generating close to 80 modules tested against more than 70 techniques. Sophos detected activity from the toolkit on a system at a customer environment, which triggered alerts. The modules appeared to bypass almost all EDR solutions after several iterations. Sophos found no evidence that AI was embedded in deployed malware or operating independently in victim environments, and the researchers described the workflow as entirely human-driven.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: systems of others were touched (a system at a customer environment) and the stated scope is one system.","harm_class":[],"affected_description":"a system at a customer environment","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/","publisher":"BleepingComputer","date":"2026-06-02","type":"press","title":"AI-built ransomware toolkit automates EDR evasion, AD discovery - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at cybersecurity company Sophos detected activity from the toolkit on a system at a customer environment that triggered alerts for payloads stored in C:\\Users\\User\\Documents\\test."}],"impact.affected_description":[{"source_index":0,"quote":"Researchers at cybersecurity company Sophos detected activity from the toolkit on a system at a customer environment that triggered alerts for payloads stored in C:\\Users\\User\\Documents\\test."}],"impact.severity":[{"source_index":0,"quote":"Researchers at cybersecurity company Sophos detected activity from the toolkit on a system at a customer environment that triggered alerts for payloads stored in C:\\Users\\User\\Documents\\test."}],"impact.severity_because":[{"source_index":0,"quote":"Researchers at cybersecurity company Sophos detected activity from the toolkit on a system at a customer environment that triggered alerts for payloads stored in C:\\Users\\User\\Documents\\test."}],"event.summary":[{"source_index":0,"quote":"A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions."},{"source_index":0,"quote":"For instance, a Claude Opus 4.5 agent acts as the coordinator of the R&D process, while others handle testing, OPSEC hardening, documentation, proxy stress testing, VM deployment, and other related tasks."},{"source_index":0,"quote":"Close to 80 modules were generated and tested against more than 70 techniques."},{"source_index":0,"quote":"Researchers at cybersecurity company Sophos detected activity from the toolkit on a system at a customer environment that triggered alerts for payloads stored in C:\\Users\\User\\Documents\\test."},{"source_index":0,"quote":"While the agents initially suggested a high failure rate, the modules appeared to bypass almost all EDR solutions after several iterations."},{"source_index":0,"quote":"Sophos found no evidence that AI was embedded in deployed malware or operating independently in victim environments."},{"source_index":0,"quote":"Despite the malware research and development orchestrated using AI technology, the researchers note that the workflow is entirely human-driven."}]},"notes_on_gaps":"No source states the date the activity occurred or was detected, the harness, the model developer, the root cause, or any remediation. The disclosure date is taken from the article metadata (2026-06-02) and the timeline's 'today' wording, which the source does not state as a date in its body. agent_involved is set true because agents performed development tasks, though the source says the workflow is entirely human-driven and finds no autonomous agent behaviour in victim environments, so no failure_class is set. The threat actor is treated as an external attacker and the severity tier of moderate is a judgement from a single customer system; 'multiple organizations' on the leak site is not a stated count. The source reports discrepancies between test output and internal reporting with unclear reasons, which are not characterised further. No safeguard held as a control is stated; J4 is recorded as got around based on the reported EDR bypass. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: BleepingComputer · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}