A recently uncovered ransomware toolkit is giving us a clear view of where things are heading. Spotted in a live environment, the toolkit uses AI to accelerate how attacks are built, tested, and refined – with a particular focus on evading detection and navigating Active Directory environments. This isn’t experimental. It’s already being used in the wild.
What makes this different
Attackers aren’t just using AI to generate code. They’re using it to structure their entire workflow: pulling in publicly available security research, extracting and adapting known bypass techniques, testing payloads against common EDR solutions, and iterating until something slips through. In this case, the attacker even built out a controlled test environment to validate whether their tooling could avoid detection before deploying it. It’s a much more disciplined, engineering-led approach, and it’s making attacks more reliable as a result.
Why it matters
The key shift here is speed. Traditionally, there’s been a gap between new techniques being published by researchers and those same techniques being used in real-world attacks. AI is shrinking that gap. Attackers can now rapidly test and refine techniques, meaning defensive controls have less time to catch up. What used to take weeks or months can now happen much faster.
What this means for your security
Most organisations still rely on a fairly standard approach: EDR deployed, alerts configured, assumption that coverage equals protection. But if attackers are actively testing their payloads against those exact tools – and refining until they bypass them – that assumption doesn’t hold up. The focus needs to shift from having controls in place to understanding how they perform under real-world conditions.
Our take
This is less about AI being “the threat” and more about what it enables: faster iteration, better testing, and more predictable outcomes for attackers. Which means static or untested security controls become a bigger risk over time. The organisations that stay ahead will be the ones that continuously validate their defences, not just deploy them.
How we can help
At Evolve North, we help organisations understand how their security actually performs in practice. That includes testing EDR and detection capabilities against real-world techniques, identifying gaps before they’re exploited, strengthening identity and Active Directory security, and providing clear, actionable insight into where improvements are needed. If you’d like to understand how your current controls would stand up to this kind of approach. Contact us at info@evolvenorth.com or call 01748 905 002.