GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
76
AI model
Composer
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 30, 2026
- Last mentioned4h ago
Timeline
2 articles · newest firstGOLD OGRE automated Aur0ra intrusions with Cursor and Claude
Agents moved from stolen VPN access to domain management, and three of those victims later hit the leak site.
74
Appears with
- Aur0ramalware · 2
- CloudSEKorganization · 2
- Sophosorganization · 2
- Gambit Securityorganization · 2
- Cobalt Strikemalware · 2
- Cursorvendor · 2
- Anthropicvendor · 2
- Claude 4.5-Sonnetai model · 2
- GOLD OGREthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.