Ransomware operators are increasingly outsourcing the hardest parts of network intrusions to AI coding agents. Sophos researchers found a group linked to the Aur0ra (Aurora) ransomware family using Cursor AI agents to escalate from stolen credentials to domain administrator — the highest level of control on a Windows network — after which they collected data and prepared for ransomware deployment.
The threat actor tracked as GOLD OGRE relied on human operators to provide VPN access, targets and high-level objectives, while AI agents performed most of the routine attack tasks with minimal human guidance. That approach lowers the technical barrier to executing full intrusions.
This is particularly significant for organizations that rely on Active Directory; Sophos’s prior reporting on the same group showed similar AI-assisted planning techniques.
Aur0ra operators used Cursor AI agents to escalate and move laterally
Sophos’s Counter Threat Unit discovered the activity while analyzing an AI-assisted testing framework built on Cursor. The framework had been used to test several endpoint detection and response (EDR) products — including Sophos’s own agent — and the same infrastructure was later observed hosting Cobalt Strike for Aur0ra operations. Sophos notified affected customers and worked with law enforcement to alert other victims.
In late August, analysts recovered Cursor configuration and chat files tied to both the evasion-testing framework and the ransomware operations. The attacker workflow used Cursor agents to progress from credential access to domain administrator privileges.
To evade AI safety checks, the operators framed activities as authorized “red team” work or “diagnostics testing.” Cursor’s Composer model executed many intrusion steps alongside models from Anthropic, xAI and Moonshot. The group initially relied heavily on Anthropic models, then added others as it moved from building tooling toward active compromises. Other ransomware groups have also used Claude for planning, indicating the technique is spreading.
Once the agents had access, they enumerated the network and searched for weak paths to privileged accounts. The agents executed commands, moved laterally between hosts, and searched file shares, user documents, backup repositories and cloud-linked storage. They attempted password spraying, Kerberoasting, NTLM coercion and NTLM relay; harvested credentials from files and backups; and used common offensive tools such as SharpShares and NetExec — the latter also appearing in reports of EDR bypasses by other ransomware families.
On several compromised networks, the agents achieved domain management access; three of those victims later appeared on the Aur0ra leak site. Stolen data was staged and uploaded to S3-compatible storage. Sophos observed an operator use a VeeamTransport command to copy data to a bucket on a server at 152[.]236[.]4[.]14. Command logs also showed input consistent with a Cyrillic keyboard layout, suggesting the operators may speak Russian.
In late August 2026, Gambit Security and CloudSEK published findings apparently based on the same exposed open directory at 172[.]86[.]113[.]245. That directory contained Windows and Linux (ESXi-ready) builds of the Aur0ra ransomware, shell history and Cursor chat logs. Gambit additionally reported a Claude 4.5–Sonnet agent used in semi-automated intrusions.
Gambit described agent-driven behaviors such as installing a VPN client, scanning subnets with Nmap or NetExec, and mapping domain relationships with BloodHound. Operators also attempted NTLM relay using PetitPotam, Coerce Plus and PrinterBug, and abused certificates with Certipy. Sophos observed many of the same tools in its testing framework, although only a single SOCKS-related IP overlapped between the two infrastructure sets.
Sophos assesses with high confidence that GOLD OGRE used AI to test tool evasions and then provided similar AI-powered capabilities to associates running Aur0ra. The company expects other ransomware groups to incorporate Cursor-style agents into their operations.
Basic security controls remain effective: patch internet-exposed systems, require phishing-resistant multi-factor authentication, and closely monitor EDR alerts. Because AI accelerates each phase of an intrusion, rapid detection and response are more important than ever. Sophos also recommends limiting attacker movement by segmenting critical servers, isolating backups, reviewing domain administrator assignments, using privileged access management, and enforcing application controls.
Indicators of compromise (IoCs)
| Indicator | Type | Context |
|---|---|---|
| 152[.]236[.]4[.]14 | IP address | Data exfiltration server used in Aur0ra ransomware operations |
| 152[.]236[.]3[.]8 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 172[.]86[.]89[.]124 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 144[.]172[.]101[.]72 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 206[.]223[.]230[.]107 | IP address | Cobalt Strike C2 server used in Aur0ra ransomware operations |
| 45[.]59[.]113[.]63 | IP address | SOCKS proxy node used in Aur0ra ransomware operations |
| 172[.]86[.]113[.]245 | IP address | Open directory server used in Aur0ra ransomware operations |
Note: IP addresses and domains are intentionally Q-defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.
