GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
76
Organization
Gambit Security
- Mentions · 7d3
- Mentions · 30d4
- All mentions9
- First seenSep 1, 2026
- Last mentioned14h ago
Timeline
9 articles · newest firstGOLD OGRE automated Aur0ra intrusions with Cursor and Claude
Agents moved from stolen VPN access to domain management, and three of those victims later hit the leak site.
74
Attackers hijack exposed Cairn panels to plant backdoors and steal API keys
NorForge saw injected tasks on at least 17 panels add SSH keys, run Poseidon, and harvest model API keys.
76
AI-assisted campaign hit 105 shops and stole 600,000 cards
Gambit Security says 27 companies were compromised for about $25.46 each; a Silverfort lab run took a domain in eight minutes for $12.
76
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
Stolen AI credentials feed growing LLM proxy economy
Team Cymru estimates more than 80,000 proxy servers hide stolen AI credentials and enable model distillation.
74
Autonomous AI Agents Hack Online Retailers for $25 Per Target, Steal 600,000 Credit Cards
Operator using open-source AI agents Strix, Cairn, and Hermes compromised hundreds of retailers, stealing 600,000+ credit cards at about $25 per target.
78
Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards
Gambit Security details an unsupervised AI-agent campaign using Strix, Cairn and Hermes that breached 27+ retailers and stole 600,000+ credit cards for about $25 per target.
78
Healthcare facilities operator Nutex says patient, employee data stolen in August incident
The Gentlemen ransomware gang claims the theft of patient and employee data from healthcare operator Nutex Health, which disclosed the extortion in SEC filings.
62
Appears with
- Anthropicvendor · 3
- Composerai model · 2
- OpenRouterorganization · 2
- CloudSEKorganization · 2
- Hermesorganization · 2
- Aur0ramalware · 2
- Strixorganization · 2
- Cursorvendor · 2
- Sophosorganization · 2
- GOLD OGREthreat actor · 2
- Palo Alto Networksorganization · 2
- Qwenai model · 2
- Cairnorganization · 2
- Claude 4.5-Sonnetai model · 2
- Magentoorganization · 2
- Cobalt Strikemalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.