The crew behind Aur0ra ransomware has been handing AI coding agents a VPN login, a SOCKS proxy and a target list, then letting the agents find their own way to the domain controller. That is the finding of the original report from the Sophos Counter Threat Unit (CTU) Research Team and Colin Cowie, who track the operators as GOLD OGRE.
Sophos assesses with high confidence that GOLD OGRE first used AI to test how well its tools slipped past endpoint detection and response (EDR) products, and then gave associates similar technology to use in live Aur0ra ransomware operations. In a subset of the environments it studied, the agents reached domain management access, and three of those victims were later named on Aur0ra's data leak site.
A testing rig that turned into a ransomware toolkit
In May 2026, CTU researchers reported on an AI-assisted post-exploitation framework, built with help from the Cursor coding tool, that was testing several vendors' EDR agents, including Sophos's own. After that testing phase, Sophos saw the same infrastructure hosting Cobalt Strike in support of Aur0ra intrusions.
The visibility Sophos gained confirmed routine use of Cobalt Strike, S3-compatible storage for stolen data, and agentic AI to climb from stolen credentials to privileged accounts. Sophos says it notified potentially affected customers and worked with law enforcement to notify other organizations. The data showed several distinct operators following the same pattern on shared command and control infrastructure. Keyboard artifacts point to Russian speakers: the logged commands "зы" and "ды" are simply ps and ls typed on a Cyrillic layout.
The agents did the hands-on-keyboard work
In late August, Sophos recovered Cursor artifacts tied to the operation. The intrusions were orchestrated by Cursor's Composer agentic coding model as well as models from Anthropic, xAI and Moonshot. The operators initially used Anthropic almost exclusively before adding the others, a shift Sophos says may track their move from building tools to running intrusions. Guardrails were sidestepped by describing the work as authorized red team activity or "diagnostics testing".
Humans supplied credentials, access and objectives. The agents then ran network and Active Directory discovery, mapped credential-based attack paths, executed commands and moved laterally with limited human involvement. Sophos observed password spraying, Kerberoasting, NTLM coercion and relay (tricking a server into authenticating to the attacker, then reusing that login), and credential extraction from files and backups. Translated prompts read like instructions to a junior tester: "Don't try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors."
The findings line up with late-August reporting from Gambit Security and CloudSEK, which both analysed an exposed open directory at 172[.]86[.]113[.]245 holding Windows and ESXi builds of Aur0ra, shell history and Cursor chat logs. We covered that exposure in our earlier report. Sophos notes tool and technique overlap was strong but infrastructure overlap was thin, with a single shared SOCKS address. The pattern echoes other crews handing intrusions to AI agents.
Segment servers and isolate backups before the agents arrive
Sophos stresses that existing controls still work: patch internet-facing devices, deploy phishing-resistant multi-factor authentication and act quickly on EDR alerts. Because the agents hunt for backups, NAS and virtualization hosts, it also recommends segmenting critical servers, isolating backups, reviewing domain administrator rights, using privileged access management and enforcing application control. Watch for Chisel SOCKS tunnels, SharpShares, BloodHound, NetExec, Certipy, PetitPotam and Kerberoasting scripts.
Indicators
- 152[.]236[.]4[.]14 (data exfiltration server)
- 152[.]236[.]3[.]8, 172[.]86[.]89[.]124, 144[.]172[.]101[.]72, 206[.]223[.]230[.]107 (Cobalt Strike C2)
- 45[.]59[.]113[.]63 (SOCKS proxy node)
- 172[.]86[.]113[.]245 (open directory server)
Sophos expects other ransomware groups and affiliates to embed agents like Cursor into their operations too. The lesson from Aur0ra is that AI does not need to invent new attacks to matter. It only has to make the old ones cheaper, quieter and available to less skilled hands.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.