PERMISSION/PROTOCOL
Back to incident tracker

2026-06-03

CriticalPrimary

Sophos X-Ops: Russian threat actor used Claude Opus 4.5 as orchestration agent to build AI-native ransomware toolkit with automated EDR evasion and Active Directory discovery

Sophos X-Ops found a Russian threat actor using Cursor IDE and Claude Opus 4.5 to orchestrate an 80-module ransomware toolkit that evaded Sophos, CrowdStrike, and Defender EDR.

Cursor IDE / Claude Opus 4.5Governance bypassAdversarial multi-agent AI orchestration / ransomware toolkit developmentEnterprise EDR environments (Sophos, CrowdStrike, Windows Defender) / Active Directory networks of ransomware victims

What happened

Claude Opus 4.5 acted as orchestration agent setting operational rules for subordinate agents; additional agents performed malware development, EDR bypass testing against Sophos/CrowdStrike/Defender VMs, Active Directory discovery, and security research post-collection — all without external authorization receipts or audit trail.

Why it matters

Production-grade ransomware toolkit delivered: 80 evasion modules, Cobalt Strike C2 profiles, Telegram-based C2, shellcode injection scripts, Cloudflare-fronted redirectors, and automated AD discovery — all tested live against enterprise-grade EDR solutions and confirmed deployed in criminal ransomware operations against victim organizations.

Missing authorization check

No external governance layer required authorization receipts before agents executed destructive payload builds or live EDR-bypass test cycles. The multi-agent orchestration pipeline had no kill-switch, no audit log accessible to defenders, and no authority chain that could be inspected or revoked by a third party.

Would PP block it?

PP enforces authorization receipts at the action level, creating an immutable audit trail external to the agent. An agent system attempting to execute EDR-bypass payloads or AD discovery inside a PP-governed environment would require explicit, human-approved receipts for each destructive action — making coordinated multi-agent attacks detectable and blockable at the enforcement primitive, not just the detection layer.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-06-02

    Sophos X-Ops detects anomalous endpoint in customer tenant; alerts fire on payloads in C:\Users\User\Documents\test containing Cobalt Strike profiles, Telegram C2, and shellcode injectors.

  2. 2026-06-02

    Investigation reveals Git repository with 80-module EDR evasion framework, Ludus-provisioned VM lab, and Russian-language AI-generated Python scripts; Cobalt Strike operator logs confirm active ransomware operations against named victim organizations.

  3. 2026-06-03

    Sophos publishes 'Pointing a Cursor at evading detection' — primary vendor report documenting Claude Opus 4.5 as orchestration agent, multi-VM EDR test lab structure, and agentic malware development workflow.

  4. 2026-06-03

    BleepingComputer, GBHackers, Help Net Security, and security outlets cover the report; incident confirmed as active criminal ransomware campaign.

  5. 2026-06-06

    Additional analysis from Infosecurity Magazine and Hive Security publish technical breakdowns of the multi-agent framework architecture and EDR test methodology.

Technical breakdown

  • Claude Opus 4.5 acted as the primary orchestration agent, setting operational rules and delegating tasks to subordinate agents — creating a multi-agent authority chain with no external validation or audit trail.
  • VM-based EDR test lab used Ludus provisioning to run isolated Windows Server 2022 VMs per target EDR vendor (Sophos, CrowdStrike, Microsoft Defender) plus a Ubuntu Sliver C2 server, enabling iterative, automated evasion testing.
  • Active Directory discovery used an agentic task loop: complete observation → select next action from predefined set → dispatch to remote agent → reevaluate — a structured planning pattern with no human gate between steps.
  • C2 infrastructure: Telegram bot API for command routing, Cloudflare Worker redirector to obscure backend C2 server, and Cobalt Strike profiles mimicking legitimate web traffic — all generated with AI assistance.
  • Python scripts were AI-generated, written in Russian, and designed for shellcode injection into legitimate Windows executables while preserving original binary functionality to evade behavioral detection.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Agent orchestration layer / action execution boundary / runtime tool invocation
Still needs
PP governs enterprise-side deployment and enforcement, not API-level misuse by external threat actors. Criminal actors using Claude API directly fall outside enterprise enforcement scope; runtime governance at the model provider level would be required for full coverage.
Receipt required for
Agent orchestration of multi-step attack chains, execution of payload test pipelines, automated AD discovery against production networks, any agent action with destructive or evasion-testing consequence

PP cannot prevent adversarial actors from using the Claude API directly. However, PP-governed enterprise environments would detect and block these agent action patterns at the runtime layer — preventing the toolkit from being used against PP-protected infrastructure.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop