Ransomware Gangs Disable EDR, Deploy AI Agents to Accelerate Attacks

Ransomware operations are becoming faster and more automated as criminal groups target the security tools designed to stop them. Endpoint detection and response, or EDR, is a core layer of corporate defense, but disabling it is increasingly part of attackers’ standard playbook. Large language models and AI agents also allow gangs to link reconnaissance, stolen-data analysis and extortion work into a more efficient attack chain.

Cybersecurity firm Halcyon said techniques for neutralizing EDR have become widespread among ransomware groups, with some operators able to deploy ransomware less than an hour after gaining access. Criminal organizations are also beginning to use large language models and AI agents to automate reconnaissance, identify valuable information in stolen datasets and support ransom negotiations, sharply reducing the time defenders have to detect, contain and respond to an intrusion.