Ransomware operators tied to the Aur0ra (Aur0ra/Aur0ra) family used AI coding agents to shorten the path from stolen credentials to full domain administrator control, then collected data and prepared ransomware deployment. Sophos researchers traced the activity to a group tracked as GOLD OGRE, which combined human-provided access and goals with Cursor AI agents that automated many intrusion steps. The result: lower skill required to run complex intrusions and faster, more systematic data theft and ransomware staging.
AI as a force multiplier
Sophos’s Counter Threat Unit uncovered a Cursor-based testing framework that had been used to evaluate endpoint detection and response products, including Sophos’s own agent. That same infrastructure later hosted Cobalt Strike components tied to Aur0ra operations. Analysts recovered Cursor files in late August that showed the agents being used to escalate privileges from credential access to domain management, and to map and probe networks for valuable data sources.
How the attackers used AI
The operators described their activities to AI models as authorized “red team” work or diagnostics testing to bypass safety restrictions. Cursor’s Composer model performed many of the intrusion tasks, and the attackers also used models from Anthropic, xAI and Moonshot. Initially they relied heavily on Anthropic, then added other models as their work shifted from developing tools to actively breaking into networks. Other reports note attackers using Claude models in similar planning and execution roles, indicating the approach is spreading.
Observed techniques and tooling
Once given access, the AI agents scanned and mapped networks, checked for weak paths to powerful accounts, and executed commands that moved laterally across machines. The observed techniques included password spraying, Kerberoasting, NTLM coercion and NTLM relay, and credential harvesting from files and backups. Common tooling seen in activity and related frameworks included SharpShares and NetExec. Operators staged stolen files and moved them to S3-compatible storage; Sophos logged a VeeamTransport command copying data to a bucket on a server at 152[.]236[.]4[.]14. Some logs also recorded inputs consistent with a Cyrillic keyboard layout, suggesting Russian-speaking operators.
Third-party findings and shared infrastructure
Gambit Security and CloudSEK published findings in late August 2026 that relied on an exposed open directory (172[.]86[.]113[.]245) containing Windows and Linux Aur0ra ransomware builds, shell histories, and Cursor chat logs. Gambit also observed a Claude 4.5-Sonnet agent in semi-automated intrusions. Their analysis described agents installing VPN clients, scanning subnets with Nmap or NetExec, and mapping domains with BloodHound. Attempts at NTLM relay via PetitPotam, Coerce Plus and PrinterBug, and certificate abuse via Certipy were also reported. Sophos assessed with high confidence that GOLD OGRE used AI to test evasive tactics and then supplied similar tooling to affiliates running Aur0ra.
Containment and defense takeaways
Because AI can accelerate every stage of an intrusion, detection and response speed becomes more critical. Sophos and other analysts recommend basic but effective defenses: patch internet-facing systems, enforce phishing-resistant multi-factor authentication, and monitor EDR alerts closely. Limiting lateral movement through network segmentation, isolating backups, reviewing domain administrator privileges, using privileged access management, and applying application control policies all reduce the blast radius of intrusions that manage to bypass initial controls.
Indicators of compromise (IoCs):-
| Indicator | Type | Context |
|---|---|---|
| 152[.]236[.]4[.]14 | IP address | Data exfiltration server used in Aur0ra ransomware operations |
| 152[.]236[.]3[.]8 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 172[.]86[.]89[.]124 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 144[.]172[.]101[.]72 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 206[.]223[.]230[.]107 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 45[.]59[.]113[.]63 | IP address | SOCKS proxy node used in Aur0ra ransomware operations |
| 172[.]86[.]113[.]245 | IP address | Open directory server used in Aur0ra ransomware operations |
Reporting and next steps for SOCs
Integrate these indicators and the contextual details into threat detection rules and playbooks. Provide SOC analysts with timely alert context so incidents can be identified and contained rapidly. Treat exposed directories, unexpected data transfers to S3-compatible buckets, and unusual domain privilege escalations as high-priority investigations. Given how AI can chain and automate intrusion steps, coordinate patching, access reviews, and backup isolation as part of an accelerated response plan.
Licensed under CC BY-ND 4.0 International