GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Original title: Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
Sophos says the Aur0ra ransomware crew, tracked as GOLD OGRE, had human operators supply VPN access and goals while Cursor agents did most of the intrusion. The agents mapped Active Directory, tried password spraying, Kerberoasting and NTLM coercion, and staged stolen files to S3-compatible storage. Sophos links the activity to an earlier AI-assisted EDR evasion framework and says it warned customers and law enforcement.
Unconfirmed: Russian-speaking operators are inferred from logs; Sophos states high confidence only for the AI-evasion link.
- Cursor’s Composer model and models from Anthropic, xAI and Moonshot were used.
- Guardrails were bypassed by calling the work authorized red teaming or diagnostics.
- One exfiltration server cited is 152.236.4.14; an open directory was at 172.86.113.245.
- Cyrillic keyboard shortcuts in logs suggest the operators speak Russian, Sophos says.
Impact: Domain administrator control and staged data theft before ransomware
- 1.Use phishing-resistant MFA and limit domain administrator rights.
- 2.Segment critical servers, isolate backups, and review EDR alerts quickly.
- ATT&CK
- T1110.003 Password SprayingT1558.003 KerberoastingT1187 Forced AuthenticationT1567.002 Exfiltration to Cloud StorageT1046 Network Service Discovery
- Threat actors
- GOLD OGRE
- Malware
- Aur0raCobalt Strike
- Organizations
- SophosGambit SecurityCloudSEK
- AI models
- ComposerClaude 4.5-Sonnet
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.101.72 | obalt Strike C2 server used in Aur0ra ransomware operations 144[.]172[.]101[.]72 IP address Cobalt Strike C2 server used in Aur0ra ran |
| ipv4 | 152.236.3.8 | ta exfiltration server used in Aur0ra ransomware operations 152[.]236[.]3[.]8 IP address Cobalt Strike C2 server used in Aur0ra ran |
| ipv4 | 152.236.4.14 | s. Indicators of compromise (IoCs):- Indicator Type Context 152[.]236[.]4[.]14 IP address Data exfiltration server used in Aur0ra ra |
| ipv4 | 172.86.113.245 | dress SOCKS proxy node used in Aur0ra ransomware operations 172[.]86[.]113[.]245 IP address Open directory server used in Aur0ra ranso |
| ipv4 | 172.86.89.124 | obalt Strike C2 server used in Aur0ra ransomware operations 172[.]86[.]89[.]124 IP address Cobalt Strike C2 server used in Aur0ra ran |
| ipv4 | 206.223.230.107 | obalt Strike C2 server used in Aur0ra ransomware operations 206[.]223[.]230[.]107 IP address Cobalt Strike C2 server used in Aur0ra ran |
| ipv4 | 45.59.113.63 | obalt Strike C2 server used in Aur0ra ransomware operations 45[.]59[.]113[.]63 IP address SOCKS proxy node used in Aur0ra ransomware |
From the original article
4 min read at cybersecuritynews.com
Ransomware crews are now giving the hardest parts of a network break-in to AI coding tools. A group linked to Aur0ra ransomware used Cursor AI agents to go from stolen passwords to domain admin access, the highest level of control in a Windows network. From there, it collected data and prepared to deploy ransomware.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.