Aur0ra ransomware group has AI agents take on most of the intrusion work
Ransomware gang talked AI agents into doing much of its dirty work
Sophos says the Aur0ra ransomware group (tracked as GOLD OGRE) used AI agents to move laterally within victim networks, collect credentials, and in some networks obtain domain administrator privileges. Traces Sophos recovered from the Cursor AI coding assistant at the end of August show that the attackers gave the agent VPN login credentials, proxy access, targets and objectives, letting it map the structure of the network and Active Directory, search for passwords in network shares, documents and backups, and move laterally, with almost no operator intervention. The intrusion and ransomware deployment were still carried out manually, and the names of three of the victims later appeared on Aur0ra's data leak site. The operators wrote prompts in Russian and described the intrusion as authorized red team activity or diagnostic testing to bypass AI tool guardrails; the attack proceeded via Cursor's Composer agent coding model as well as models from Anthropic, xAI and Moonshot.
Sophos forensics reconstructed the specific division of labor by which the group handed reconnaissance and lateral movement to AI agents, which security teams can use to check coding assistant logs and EDR alerts.