GOLD OGRE uses Cursor and Claude AI agents to automate Aur0ra ransomware intrusions up to domain admin

Linha do tempo

1. helpnetsecurity.com ↗ · pub. 02/11/2026 02:00 · coletado 02/11 03:01

   GOLD OGRE's Aur0ra ransomware operators use AI agents to harvest credentials and reach domain admin

   ler a análise desta fonte ocultar

   Sophos reports that the group behind the Aur0ra ransomware, tracked as GOLD OGRE, has used AI agents to move through victim networks, collect credentials and escalate to domain administrator access. Artifacts recovered from the Cursor AI coding assistant in late August show operators handing agents VPN logins, proxy access, targets and objectives. In some networks the agents obtained domain management access, and three of those victims were later named on Aur0ra's data leak site. Initial access and ransomware deployment remained under human control.

   Technical Details

   • Agents mapped the network and Active Directory, searched network shares, documents and backups for passwords, and moved laterally with little human input.
   • Operators supplied a SOCKS5 proxy and user accounts, told agents to stop brute-forcing domain admin accounts in favor of quieter methods, and asked them to locate backup servers, NAS and virtualization systems.
   • Prompts were written in Russian, and Cyrillic keyboard slips in logs suggest Russian-speaking operators.
   • To bypass guardrails, attackers framed activity as authorized red team or diagnostic testing.
   • Models used: Cursor's Composer, plus models from Anthropic, xAI and Moonshot. Anthropic was used almost exclusively at first, with other models added as the actors shifted from tool building to intrusions.
   • Sophos CTU assesses with high confidence that GOLD OGRE used AI to test tool evasion of EDR products, then gave associates similar technology for Aur0ra attacks.
   • Gambit Security and CloudSEK published analyses apparently based on the same exposed open directory; Gambit mentions a Claude 4.5-Sonnet agent in semi-automated attacks.

   Remediation

   Sophos says existing controls remain effective: patch internet-facing devices, deploy phishing-resistant MFA and monitor EDR alerts, with emphasis on fast response.

2. gbhackers.com ↗ · pub. 30/10/2026 11:35 · coletado 30/10 12:00 primeiro registro

   GOLD OGRE weaponizes Cursor and Claude AI agents to automate Aur0ra ransomware intrusions

   ler a análise desta fonte ocultar

   Sophos Counter Threat Unit (CTU) reports that the cybercrime group GOLD OGRE is using AI coding agents — notably Cursor (Composer agentic model) and Anthropic Claude, plus models from xAI and Moonshot — to automate intrusions supporting Aur0ra (Aurora) ransomware. Agents escalated from credential access to domain administrator with minimal human involvement, with operators only supplying VPN credentials, SOCKS access, targets and objectives. Guardrails were bypassed by framing the activity as authorized red-team or "diagnostics testing" work; Russian-language prompts and keyboard-layout artifacts suggest Russian-speaking operators. At least three victims where agents obtained domain management access later appeared on the Aur0ra leak site. Sophos assesses with high confidence that GOLD OGRE first tested AI-driven EDR evasion and then distributed similar tooling to affiliates, and expects other ransomware crews to follow.

   Technical Details

   In May 2026 Sophos CTU documented an AI-assisted post-exploitation framework built to test multiple vendors' EDR products, including Sophos; the same infrastructure was later seen hosting Cobalt Strike for Aur0ra operations. Agents performed Active Directory discovery, credential attack-path analysis and lateral movement, searching network shares, backups and cloud-connected storage. Observed techniques include password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups. Operators instructed agents to avoid noisy brute-forcing of domain admin accounts and to prioritize backup servers, NAS and virtualization hosts. Data was staged and exfiltrated to S3-compatible storage; one operator used a VeeamTransport-named binary to copy data to an S3 bucket at 152.236.4.14. In late August 2026, Gambit Security and CloudSEK described similar activity from an exposed open directory at 172.86.113.245 holding Windows and ESXi Aur0ra binaries, shell history and Cursor chat logs, with a Claude 4.5-Sonnet agent running semi-automated attacks using Nmap, NetExec, BloodHound, PetitPotam, Impacket and Certipy; the only infrastructure overlap is the SOCKS IP 45.59.113.63.

   Remediation

   Patch internet-facing devices, deploy phishing-resistant MFA, and monitor and respond rapidly to EDR alerts. Segment critical servers, isolate backups, review domain admin privileges, and enforce privileged access management and application control.