Sophos Says the GOLD OGRE Ransomware Crew Had Cursor's AI Agents Work From Stolen VPN Logins to Domain Admin, Then Named Three of the Victims on Its Aur0ra Leak Site

SINGAPORE - The cybercriminal group behind the Aur0ra ransomware used AI coding agents to work its way from stolen VPN credentials to control of victims' Windows domains, according to a report published on Thursday by the Sophos Counter Threat Unit. Sophos tracks the group as GOLD OGRE and says the agents did much of the hands-on intrusion work "with limited human involvement," while human operators chose the targets and handled the payoff.

In a subset of the environments Sophos examined, the agents achieved domain management access. Three of those victims were later named on Aur0ra's data leak site, the researchers wrote.

The report ties two threads together. In May, Sophos researchers published work on an AI-assisted post-exploitation framework that tested how well several vendors' endpoint detection and response products, including Sophos's own agent, held up against it. After that testing phase, Sophos analysts saw the same infrastructure hosting Cobalt Strike in support of Aur0ra operations. The framework, Sophos says, was developed with help from Cursor, the AI coding tool.

How the agents were used

In late August, Sophos analysts recovered Cursor artifacts associated with Aur0ra operations and with the group's EDR evasion testing. According to the report, the operators supplied the agents with VPN credentials, SOCKS access, targets and objectives. The agents then carried out network and Active Directory discovery, analyzed credential-based attack paths, executed commands and moved laterally.

In several environments, the agents searched network shares, user documents, backup repositories and cloud-connected storage while running password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups. Intrusions were orchestrated by Cursor's Composer agentic coding model and by models from Anthropic, xAI and Moonshot. Sophos says the operators initially used Anthropic almost exclusively before introducing other models, a shift that may reflect a move from building tools to conducting intrusions.

The guardrails on those models did not stop the work. "AI guardrails were bypassed by framing the intrusions as authorized red team activity or 'diagnostics testing,'" the researchers wrote. The prompts Sophos published read like a manager's instructions to a penetration tester. One, translated from Russian, tells the agent: "Don't try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors." Another asks it to enumerate "the backup servers, NAS servers, virtualization" across the entire infrastructure.

Sophos says the operators appear to be Russian speakers. Its analysts found the strings "зы" and "ды" in operator logs, which become ps and ls, the commands for listing processes and directories, when typed on a Cyrillic keyboard layout.

Shared tooling, multiple operators

The research data showed several distinct operators following the same pattern on shared command-and-control infrastructure and toolkits: Active Directory enumeration and lateral movement, with a focus on collecting data from network shares. In one example, an operator escalated privileges, injected into processes, abused credentials and tokens, enumerated shares with SharpShares and then moved data in a way Sophos describes as consistent with staging and exfiltration to an S3 bucket, in a logged command that began with VeeamTransport and copied data to an S3 path at 152.236.4.14 on port 54410.

Sophos says it notified potentially affected customers and worked with law enforcement to notify other affected organizations.

The findings line up with outside research. In late August, Gambit Security and CloudSEK published reports on Aur0ra built on what appears to be the same exposed open directory at 172.86.113.245, which held Windows and Linux builds of the ransomware, including an ESXi-compatible version, along with shell history and Cursor chat logs. Gambit described a Claude 4.5-Sonnet agent in semi-automated attacks that installed a VPN client, scanned subnets with Nmap or NetExec, collected domain data with BloodHound, attempted NTLM relay through PetitPotam, Coerce Plus and PrinterBug, relayed the result with Impacket and ran certificate attacks with Certipy.

Those tools overlap with what Sophos saw in the testing framework, though shared infrastructure was thin: one SOCKS-related address, 45.59.113.63, appears in both. Sophos assesses with high confidence that GOLD OGRE used AI to test evasion tools and techniques in a Cursor-enabled framework and then gave associates similar technology for ransomware operations. "It is highly likely that other ransomware groups and their affiliates will embed AI agents like Cursor into their operations as well," the researchers wrote.

What defenders can hunt

For a SOC, the practical point is that agent-driven intrusions still use familiar tools, and the detections are the familiar ones. The Taegis countermeasures Sophos listed cover Chisel SOCKS tunnels, WMI enumeration of all computers, LDAP queries for domain trusts, Nmap, BloodHound, SharpShares, NetExec, Certipy output files, PetitPotam, two Kerberoasting variants and Cobalt Strike named pipes and stager persistence. Sophos also published seven network indicators: the exfiltration server 152.236.4.14; Cobalt Strike servers at 152.236.3.8, 172.86.89.124, 144.172.101.72 and 206.223.230.107; the SOCKS node 45.59.113.63; and the open directory at 172.86.113.245. Sophos notes that IP addresses can be reallocated.

Sophos argues that AI shortens the attack chain and lowers the skill needed but does not make existing controls obsolete. It recommends patching internet-facing devices, phishing-resistant multifactor authentication and close monitoring of EDR alerts, with an emphasis on fast response, along with controls that limit movement inside a network: segmenting critical servers, isolating backups, reviewing domain administrator privileges, privileged access management and application control.