GOLD OGRE used AI agents to run Aur0ra ransomware intrusions
First merged summary.
Sophos says GOLD OGRE had Cursor and other AI agents run most of Aur0ra intrusions after humans supplied VPN access and goals.
Sophos reports that Aur0ra ransomware operators, tracked as GOLD OGRE, gave human-supplied VPN access and objectives to Cursor agents that then did most of the intrusion with little further human involvement. The agents mapped Active Directory, tried password spraying, Kerberoasting and NTLM coercion, moved laterally, and staged stolen files to S3-compatible storage, including via a VeeamTransport-named binary. Sophos says the group first relied almost entirely on Anthropic models, then added xAI and Moonshot models, and that Cursor’s Composer model was also used. Guardrails were bypassed by describing the work as authorized red teaming or diagnostics, according to Sophos. Three networks where agents gained domain management later appeared on the Aur0ra leak site. Sophos links the activity to an earlier AI-assisted EDR evasion framework, warned customers and law enforcement, and expects other crews to adopt similar agents.
- Humans supplied VPN access and goals; agents handled discovery, credentials and lateral movement.
- Models used: Cursor Composer, Anthropic, then xAI and Moonshot.
- Operators told agents to avoid noisy domain-admin brute force and prioritize backups.
- Exfiltration cited a bucket at 152.236.4.14 and an open directory at 172.86.113.245.
- Only shared infrastructure with Gambit noted is SOCKS IP 45.59.113.63.
- Cyrillic keyboard shortcuts in logs suggest Russian-speaking operators, Sophos says.
What each outlet adds
beyond the shared facts- GBHackersOperator instructions, VeeamTransport binary, and Gambit/CloudSEK overlap limited to one SOCKS IP.
- Cyber Security NewsGuardrail bypass framing, open directory IP, Cyrillic logs, and law-enforcement warning.
- Threat actors
- GOLD OGRE
- Malware
- Aur0raCobalt Strike
- Organizations
- SophosGambit SecurityCloudSEK
- AI models
- ComposerClaude 4.5-Sonnet
Coverage
oldest first · one row per article · UTC- · 4h ago
GBHackersFirst report
GOLD OGRE automated Aur0ra intrusions with Cursor and Claude
Agents moved from stolen VPN access to domain management, and three of those victims later hit the leak site.
- · 4h ago
Cyber Security News
GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.