GOLD OGRE weaponizes Cursor and Claude AI agents to automate Aur0ra ransomware intrusions
Sophos Counter Threat Unit (CTU) reports that the cybercrime group GOLD OGRE is using AI coding agents — notably Cursor (Composer agentic model) and Anthropic Claude, plus models from xAI and Moonshot — to automate intrusions supporting Aur0ra (Aurora) ransomware. Agents escalated from credential access to domain administrator with minimal human involvement, with operators only supplying VPN credentials, SOCKS access, targets and objectives. Guardrails were bypassed by framing the activity as authorized red-team or "diagnostics testing" work; Russian-language prompts and keyboard-layout artifacts suggest Russian-speaking operators. At least three victims where agents obtained domain management access later appeared on the Aur0ra leak site. Sophos assesses with high confidence that GOLD OGRE first tested AI-driven EDR evasion and then distributed similar tooling to affiliates, and expects other ransomware crews to follow.
Detalhes técnicos
In May 2026 Sophos CTU documented an AI-assisted post-exploitation framework built to test multiple vendors' EDR products, including Sophos; the same infrastructure was later seen hosting Cobalt Strike for Aur0ra operations. Agents performed Active Directory discovery, credential attack-path analysis and lateral movement, searching network shares, backups and cloud-connected storage. Observed techniques include password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups. Operators instructed agents to avoid noisy brute-forcing of domain admin accounts and to prioritize backup servers, NAS and virtualization hosts. Data was staged and exfiltrated to S3-compatible storage; one operator used a VeeamTransport-named binary to copy data to an S3 bucket at 152.236.4.14. In late August 2026, Gambit Security and CloudSEK described similar activity from an exposed open directory at 172.86.113.245 holding Windows and ESXi Aur0ra binaries, shell history and Cursor chat logs, with a Claude 4.5-Sonnet agent running semi-automated attacks using Nmap, NetExec, BloodHound, PetitPotam, Impacket and Certipy; the only infrastructure overlap is the SOCKS IP 45.59.113.63.
Remediação
Patch internet-facing devices, deploy phishing-resistant MFA, and monitor and respond rapidly to EDR alerts. Segment critical servers, isolate backups, review domain admin privileges, and enforce privileged access management and application control.
Linha do tempo
-
GOLD OGRE weaponizes Cursor and Claude AI agents to automate Aur0ra ransomware intrusions
ler a análise desta fonte ocultar
Sophos Counter Threat Unit (CTU) reports that the cybercrime group GOLD OGRE is using AI coding agents — notably Cursor (Composer agentic model) and Anthropic Claude, plus models from xAI and Moonshot — to automate intrusions supporting Aur0ra (Aurora) ransomware. Agents escalated from credential access to domain administrator with minimal human involvement, with operators only supplying VPN credentials, SOCKS access, targets and objectives. Guardrails were bypassed by framing the activity as authorized red-team or "diagnostics testing" work; Russian-language prompts and keyboard-layout artifacts suggest Russian-speaking operators. At least three victims where agents obtained domain management access later appeared on the Aur0ra leak site. Sophos assesses with high confidence that GOLD OGRE first tested AI-driven EDR evasion and then distributed similar tooling to affiliates, and expects other ransomware crews to follow.
Technical Details
In May 2026 Sophos CTU documented an AI-assisted post-exploitation framework built to test multiple vendors' EDR products, including Sophos; the same infrastructure was later seen hosting Cobalt Strike for Aur0ra operations. Agents performed Active Directory discovery, credential attack-path analysis and lateral movement, searching network shares, backups and cloud-connected storage. Observed techniques include password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups. Operators instructed agents to avoid noisy brute-forcing of domain admin accounts and to prioritize backup servers, NAS and virtualization hosts. Data was staged and exfiltrated to S3-compatible storage; one operator used a VeeamTransport-named binary to copy data to an S3 bucket at 152.236.4.14. In late August 2026, Gambit Security and CloudSEK described similar activity from an exposed open directory at 172.86.113.245 holding Windows and ESXi Aur0ra binaries, shell history and Cursor chat logs, with a Claude 4.5-Sonnet agent running semi-automated attacks using Nmap, NetExec, BloodHound, PetitPotam, Impacket and Certipy; the only infrastructure overlap is the SOCKS IP 45.59.113.63.
Remediation
Patch internet-facing devices, deploy phishing-resistant MFA, and monitor and respond rapidly to EDR alerts. Segment critical servers, isolate backups, review domain admin privileges, and enforce privileged access management and application control.