Sophos uncovers AI-powered malware lab built for EDR evasion

Sophos uncovered an AI-powered malware-testing framework used by a threat actor to develop and refine endpoint detection and response (EDR) evasion techniques. The investigation began after an anomalous endpoint in a customer environment triggered alerts tied to malicious payloads from a testing directory, which included Cobalt Strike profiles designed to disguise beacon traffic as legitimate web requests. The discovery highlights the growing use of AI by adversaries to automate and enhance evasion strategies against security defenses.