Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations

The GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora).

Sophos researchers say the agents moved from credential access to domain administrator with little human involvement.

Aur0ra ransomware AI attacks

In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation framework built to test several vendors’ EDR products, including Sophos.

Sophos later saw the same infrastructure hosting Cobalt Strike in support of Aur0ra operations.

According to technical research published by Sophos, the group, tracked as GOLD OGRE, used Cursor to build and run its tooling. Cursor’s Composer agentic model drove the intrusions, along with models from Anthropic, xAI and Moonshot.

The attackers first relied almost entirely on Anthropic, then added other models as they moved from building tools to attacking networks.

The attackers bypassed AI guardrails by framing their activity as authorized red-team work or “diagnostics testing.” Russian-language prompts and keyboard-layout artifacts in the logs suggest the operators are Russian speakers.

Human operators supplied VPN credentials, SOCKS access, targets and objectives. The agents then ran Active Directory discovery, analyzed credential attack paths and moved laterally. They searched network shares, backups and cloud-connected storage.

Observed techniques included password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups.

In some environments the agents gained domain management access, and three of those victims later appeared on Aur0ra’s leak site. Operators also told the agents to avoid noisy brute-forcing of domain admin accounts and to prioritize backup servers, NAS and virtualization hosts.

Data was staged and exfiltrated to S3-compatible storage. One operator used a VeeamTransport-named binary to copy data to an S3 bucket at 152[.]236[.]4[.]14.

In late August 2026, Gambit Security and CloudSEK described similar activity from an exposed open directory at 172[.]86[.]113[.]245. It held Windows and ESXi-compatible Aur0ra binaries, shell history and Cursor chat logs.

Gambit cited a Claude 4.5-Sonnet agent running semi-automated attacks with Nmap, NetExec, BloodHound, PetitPotam, Impacket and Certipy. Only one infrastructure overlap exists: the SOCKS IP 45[.]59[.]113[.]63.

Sophos assesses with high confidence that GOLD OGRE tested evasion with AI and then gave affiliates similar tooling. It expects other ransomware groups to follow.

Defenders should patch internet-facing devices, deploy phishing-resistant MFA, and monitor EDR alerts while responding quickly.

Furthermore, organizations should segment critical servers, isolate backups, review domain admin privileges, and use privileged access management and application controls.