GOLD OGRE

GOLD OGRE is a financially motivated cybercriminal threat group that operates the Aur0ra (Aurora) ransomware. Aur0ra operates as a closed program that does not openly advertise as a ransomware-as-a-service (RaaS). Aur0ra has been active since April 2026, publishing nearly 40 victims to its dedicated leak site through September 2026. Over the April through June 2026 timeframe, CTU researchers assess the group successfully compromised approximately 30 organizations of which only 10 were ultimately published on their leak site. Most Aur0ra victims are concentrated in the United States and western Europe. GOLD OGRE's dwell time ranges from 12 hours to 9 days with ransom demands observed to exceed $1 million USD. GOLD OGRE uses stolen credentials to access potential victims through VPN services exposed to the Internet. The group uses Cobalt Strike Beacon and ISL Light Client for establishing and maintaining remote access. SharpShares and common living-off-the-land (LOLbin) utilities like nltest are used for internal reconnaissance. GOLD OGRE uses a combination of pass-the-hash (via Cobalt Strike), RDP, and SOCKS5 for lateral movement. GOLD OGRE operators have been observed exfiltrating data from compromised network to S3-compatible storage buckets using the s5cmd utility prior to data encryption. The group relies heavily on commercial artificial intelligence (AI) platforms to design and build payloads, process reconnaissance output, triage exfiltrated data, and to orchestrate network exploitation and lateral movement.