Aur0ra’s AI-Driven Leap: How Cursor Agents Helped Hackers Reach Domain Admin
Ransomware operators tied to the Aur0ra (Aur0ra/Aur0ra) family used AI coding agents to shorten the path from stolen credentials to full domain administrator control, then collected data and prepared ransomware deployment. Sophos researchers traced the activity to a group tracked as GOLD OGRE, which combined human-provided access and goals with Cursor AI agents that automated many intrusion steps. The result: lower skill required to run complex intrusions and faster, more…