GOLD OGRE's Aur0ra ransomware operators use AI agents to harvest credentials and reach domain admin
Sophos reports that the group behind the Aur0ra ransomware, tracked as GOLD OGRE, has used AI agents to move through victim networks, collect credentials and escalate to domain administrator access. Artifacts recovered from the Cursor AI coding assistant in late August show operators handing agents VPN logins, proxy access, targets and objectives. In some networks the agents obtained domain management access, and three of those victims were later named on Aur0ra's data leak site. Initial access and ransomware deployment remained under human control.
Detalhes técnicos
- Agents mapped the network and Active Directory, searched network shares, documents and backups for passwords, and moved laterally with little human input.
- Operators supplied a SOCKS5 proxy and user accounts, told agents to stop brute-forcing domain admin accounts in favor of quieter methods, and asked them to locate backup servers, NAS and virtualization systems.
- Prompts were written in Russian, and Cyrillic keyboard slips in logs suggest Russian-speaking operators.
- To bypass guardrails, attackers framed activity as authorized red team or diagnostic testing.
- Models used: Cursor's Composer, plus models from Anthropic, xAI and Moonshot. Anthropic was used almost exclusively at first, with other models added as the actors shifted from tool building to intrusions.
- Sophos CTU assesses with high confidence that GOLD OGRE used AI to test tool evasion of EDR products, then gave associates similar technology for Aur0ra attacks.
- Gambit Security and CloudSEK published analyses apparently based on the same exposed open directory; Gambit mentions a Claude 4.5-Sonnet agent in semi-automated attacks.
Remediação
Sophos says existing controls remain effective: patch internet-facing devices, deploy phishing-resistant MFA and monitor EDR alerts, with emphasis on fast response.
Linha do tempo
-
GOLD OGRE's Aur0ra ransomware operators use AI agents to harvest credentials and reach domain admin
ler a análise desta fonte ocultar
Sophos reports that the group behind the Aur0ra ransomware, tracked as GOLD OGRE, has used AI agents to move through victim networks, collect credentials and escalate to domain administrator access. Artifacts recovered from the Cursor AI coding assistant in late August show operators handing agents VPN logins, proxy access, targets and objectives. In some networks the agents obtained domain management access, and three of those victims were later named on Aur0ra's data leak site. Initial access and ransomware deployment remained under human control.
Technical Details
- Agents mapped the network and Active Directory, searched network shares, documents and backups for passwords, and moved laterally with little human input.
- Operators supplied a SOCKS5 proxy and user accounts, told agents to stop brute-forcing domain admin accounts in favor of quieter methods, and asked them to locate backup servers, NAS and virtualization systems.
- Prompts were written in Russian, and Cyrillic keyboard slips in logs suggest Russian-speaking operators.
- To bypass guardrails, attackers framed activity as authorized red team or diagnostic testing.
- Models used: Cursor's Composer, plus models from Anthropic, xAI and Moonshot. Anthropic was used almost exclusively at first, with other models added as the actors shifted from tool building to intrusions.
- Sophos CTU assesses with high confidence that GOLD OGRE used AI to test tool evasion of EDR products, then gave associates similar technology for Aur0ra attacks.
- Gambit Security and CloudSEK published analyses apparently based on the same exposed open directory; Gambit mentions a Claude 4.5-Sonnet agent in semi-automated attacks.
Remediation
Sophos says existing controls remain effective: patch internet-facing devices, deploy phishing-resistant MFA and monitor EDR alerts, with emphasis on fast response.