A reported ransomware toolkit suspected of using AI coding assistants (Cursor IDE and Anthropic’s Claude Opus) is reportedly automating Active Directory enumeration and evasion of enterprise EDR platforms including Sophos Intercept X, CrowdStrike Falcon, and Microsoft Defender for Endpoint. By generating evasion code dynamically, the toolkit is reported to lower the technical skill required to operate ransomware, potentially expanding the pool of threat actors capable of executing such attacks. Organizations relying on EDR as a sole primary defense layer (without compensating AD controls, MFA, or behavioral monitoring) may face elevated ransomware risk; AD compromise enables rapid lateral movement to domain controllers and mass encryption events.