Aur0ra ransomware group uses Cursor AI agent to gain domain administrator privileges and steal data

Sophos's threat research unit said that a group linked to Aur0ra ransomware and tracked as GOLD OGRE used a Cursor AI agent to go from stolen credentials all the way to domain administrator privileges, then collected data and prepared to deploy ransomware. The attackers described the tasks as authorized red-team work or diagnostic testing to bypass AI safety rules; the intrusion was mainly carried out by Cursor's Composer model, and models from Anthropic, xAI and Moonshot were also used. The agent completed network mapping, lateral movement, password spraying, Kerberoasting and NTLM coercion and relay, and extracted credentials from files and backups; in some victims' networks the agent obtained domain administrator privileges, and three of the victims later appeared on the Aur0ra leak site, with stolen files staged and sent to S3-compatible storage. Sophos recommends patching internet-facing devices, adopting phishing-resistant multi-factor authentication, isolating backups, reviewing domain administrator privileges and segmenting critical servers.