> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Aur0ra ransomware gang uses AI agents for automated network intrusion - URL: https://f4n6.co.uk/security-feed/aur0ra-ransomware-gang-uses-ai-agents-for-automated-network-intrusion/ - Published: 2026-11-02T10:51:15.000Z - Updated: 2026-11-02T10:51:15.000Z - Author: Jeff Davies - Tags: #security-feed, Aur0ra, GOLD OGRE ## 1\. Executive summary Sophos reports that the group behind the Aur0ra ransomware, which it tracks as GOLD OGRE, used AI coding agents to map victim networks and Active Directory, hunt for credentials in shares, documents and backups, and move laterally, reaching domain management access in some networks. Three victims where the agents gained domain management access were later named on Aur0ra's data leak site. Breaking in and deploying the ransomware stayed under human control. No CVE, affected product version or exploitation state is recorded for this item, and neither Aur0ra nor GOLD OGRE has a MITRE ATT&CK profile, so the attribution to a single group is unconfirmed. The risk to EMEA financial services is that credential discovery and lateral movement, the phases that most often precede extortion, can now run with less operator involvement and lower technical skill, which shortens the window between first access and domain compromise. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The intrusion path here runs through credential discovery in shares, documents and backups and lateral movement to domain administrator access, so the incident management process has to detect and contain hands-on-keyboard activity before ransomware deployment | Detection and response procedures need to cover credential access and lateral movement, not only the ransomware payload | | DORA Art. 28 | The attackers reached victims through VPN logins and proxy access handed to the agents, so remote access paths and any third-party providers that supply them are in scope | Review remote access and proxy arrangements with ICT third-party providers for the access the agents were given | No NIS2 or UK NIS article is engaged by the facts in this item. ## 3\. Technical analysis & attack chain The confirmed sequence, from Sophos artifacts recovered from the Cursor AI coding assistant in late August: 1. Operators supplied the AI agents with VPN logins, proxy access, targets and objectives. 2. The agents mapped the network and Active Directory. 3. The agents hunted for passwords in network shares, documents and backups. 4. The agents moved laterally with little input from the people directing them. 5. In some networks the agents gained domain management access. Three of those victims were later named on Aur0ra's data leak site. 6. Breaking in and deploying the ransomware stayed under human control. The attacks ran through Cursor's Composer agentic coding model and models from Anthropic, xAI and Moonshot. Sophos quotes its own analysis that the operators initially used Anthropic almost exclusively and then introduced other models, possibly as they moved from building tools to conducting intrusions. To get around the guardrails in the AI tools, the attackers described the intrusions as authorized red team activity or diagnostic testing. Operator prompts were recovered. One said the Windows AD network needed testing and offered to set up a SOCKS5 proxy and user accounts for the agent. Another told the agent: "Don't try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors." A third asked the agent to find the backup servers, NAS servers and virtualization systems in the victim's infrastructure. Operator logs contained keyboard slips typed in Cyrillic, which Sophos says suggest the operators are Russian speakers. Sophos's Counter Threat Unit assesses with high confidence that GOLD OGRE used AI to test whether its tools could evade EDR products, then gave associates similar technology for Aur0ra attacks. The researchers consider it highly likely that other ransomware groups will build AI agents into their operations. Gambit Security and CloudSEK published separate analyses of Aur0ra operations, both apparently based on the same exposed open directory. Gambit's report mentions a Claude 4.5-Sonnet agent deployed in semi-automated attacks. The Hacker News reports the two analyses cover attacks against 10 targets, but the primary item does not state a victim count, so treat the figure of 10 as single-sourced to that outlet. The initial access vector is not stated in public reporting. No exploited CVE, affected product version or fixed release is named. The specific tools the agents used for credential dumping or lateral movement are not stated. The attribution to GOLD OGRE rests on Sophos's tracking and is single-sourced; neither Aur0ra nor GOLD OGRE has a MITRE ATT&CK profile, so the actor mapping is unconfirmed. ## 4\. Mitigation & containment P1 within 24h - Hunt for AI coding assistant artifacts on endpoints and in developer environments, starting with Cursor, and review any agent session logs for prompts referencing VPN logins, SOCKS5 proxies, domain administrator accounts, backup servers, NAS servers or virtualization systems. The late-August Cursor artifacts are the recovery point Sophos used. - Review VPN and proxy access logs for sessions that map Active Directory, enumerate network shares, or read documents and backups outside normal patterns, and disable accounts showing that behaviour. - Reset credentials for any account the agents could reach through shares, documents or backups, and rotate domain administrator credentials where domain management access is suspected. P2 within 72h - Enforce phishing-resistant MFA on VPN and remote access, which Sophos names as still effective against this activity. - Restrict access to backup servers, NAS systems and virtualization management interfaces to named administrative accounts, since the operators specifically tasked agents to find these systems. - Tune EDR alerting for credential discovery and lateral movement and set a fast response path, which Sophos identifies as the condition for successful defence. P3 within 7 days - Review whether staff and contractors use AI coding assistants with agentic modes on corporate networks, and whether those tools can reach production segments, domain controllers or backup infrastructure. - Add detection for agent sessions that describe intrusions as authorized red team activity or diagnostic testing, the cover story the operators used to bypass tool guardrails. No fixed release or vendor patch is named in public reporting for this item, because no CVE or affected product is identified. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe behaviours but give no atomic indicators such as hashes, domains or IP addresses. The behaviours below are the observable patterns Sophos and the related analyses describe. ### Behavioural indicators | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | ---------------------------------------------- | | AI agent session maps network and Active Directory after being given VPN logins and proxy access | Cursor and other AI coding assistant session logs, endpoint telemetry | High (Sophos) | | Agent searches network shares, documents and backups for passwords | File access auditing, EDR file-read telemetry | High (Sophos) | | Operator prompt instructs agent to avoid brute-forcing domain administrator accounts and use less noisy methods | AI assistant prompt and session logs | High (Sophos) | | Operator prompt asks agent to locate backup servers, NAS servers and virtualization systems | AI assistant prompt and session logs | High (Sophos) | | Intrusions described to the AI tool as authorized red team activity or diagnostic testing | AI assistant prompt and session logs | High (Sophos) | | SOCKS5 proxy and user accounts set up for agent use | Proxy logs, account creation events | High (Sophos) | | Cyrillic keyboard slips in operator logs | AI assistant session logs | Medium (Sophos inference on operator language) | ## 6\. Detection The sources give operator prompt text and behavioural patterns but no file artefacts, command-line flags, mutexes, registry keys or file paths from the malicious tooling. A YARA rule built on prompt text would detect reporting about the threat rather than the threat, so none is emitted. The Sigma rule below targets the observable behaviour of an AI coding assistant process reaching credential stores and backup infrastructure. ```yaml title: AI Coding Assistant Process Accessing Credential and Backup Infrastructure id: 8f2c1a4e-aur0ra-ai-agent-lateral status: experimental description: Detects an AI coding assistant process (e.g. Cursor) reading network shares, backup servers, NAS systems or virtualization management interfaces, consistent with Aur0ra operators tasking AI agents to hunt credentials and locate backup infrastructure. author: Adverse Trace date: 2026-11-02 references: - https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/ logsource: category: process_creation product: windows detection: selection_image: Image|endswith: - '\Cursor.exe' selection_network: DestinationPort: - 445 - 2049 - 443 condition: selection_image and selection_network falsepositives: - Developer use of an AI coding assistant against file shares or management interfaces level: medium ``` The rule uses only the Cursor product name and standard service ports named or implied by the source behaviour; it does not rely on any string the sources do not provide. Tune the destination ports to the client's backup, NAS and virtualization management ranges. ## 7\. Sources - Help Net Security, "Ransomware gang talked AI agents into doing much of its dirty work", https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/, 2026-11-02 - The Hacker News, "Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets", https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html ## 8\. Adverse Trace position Adverse Trace assesses this as a medium-severity item for EMEA financial services: the reporting describes a real intrusion technique with confirmed domain compromise at unnamed victims, but it names no CVE, no affected product version, no fixed release and no atomic indicators, and the attribution to GOLD OGRE rests on a single vendor, Sophos, with no MITRE ATT&CK profile for either Aur0ra or GOLD OGRE. The client impact is concentrated in detection and response: credential discovery in shares, documents and backups and lateral movement to domain administrator access are the phases to instrument, and the operators' own prompt to avoid noisy brute-forcing tells defenders that quiet credential access is the pattern to look for. We will track Sophos, Gambit Security and CloudSEK publications for atomic indicators and any named initial access vector, and we will update this advisory if a CVE or fixed release is identified. --- [Read the original source →](https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*