Case sophos-cursor-edr-evasion-labAI-assisted malwareWorldwide
Sophos finds ransomware-linked actor using Cursor and Claude agents to build EDR evasions
Sophos X-Ops caught a threat actor inside a customer tenant using Cursor with a Claude Opus 4.5 agent, sub-agents, Git via MCP and Ludus VMs to build nearly 80 modules testing 70-plus EDR evasion techniques.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 2, 2026
- Location
- Worldwide
- Target
- Sophos customer tenant; Sophos, CrowdStrike and Defender EDR
- Severity
- High
- Triggered by
- Unknown Russian-speaking ransomware-linked actor
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Sophos X-Ops caught a threat actor inside a customer tenant using Cursor with a Claude Opus 4.5 agent, sub-agents, Git via MCP and Ludus VMs to build nearly 80 modules testing 70-plus EDR evasion techniques.
Impact: Evasion toolkit versioned in Git and later tied to ransomware operations; Sophos noted claimed success rates were not supported by test output.
Who triggered it
Actor: Unknown Russian-speaking ransomware-linked actor
Attribution: Sophos CTU linked the activity to known ransomware deployment and data theft; many scripts were written in Russian.
Motive: Ransomware and data theft enablement
How it happened
Attack vector: Agentic coding workflow producing Rust and Go payloads, Cobalt Strike profiles, Telegram C2 and Cloudflare Worker redirector
Root cause: Red team framing bypassed Claude guardrails; agent orchestration compressed weeks of evasion testing into days
Timeline
- Anomalous endpoint triggers alerts on payloads in a test directory
- Sophos X-Ops publishes findings
Response
Sophos published indicators and urged defence in depth.
Current status: Ongoing
Sources (open in a new tab)
- Sophos X-Ops sophos.com
- Hexnode Threat Watch hexnode.com
Cite this case
Sophos finds ransomware-linked actor using Cursor and Claude agents to build EDR evasions. AI Threat Watch, case sophos-cursor-edr-evasion-lab, Jun 2, 2026. https://aithreat.io/cases/sophos-cursor-edr-evasion-lab/
Permanent link: https://aithreat.io/cases/sophos-cursor-edr-evasion-lab/