Aur0ra ransomware operators have used commercial AI tools to develop evasion techniques and coordinate live intrusions. Sophos linked the activity to GOLD OGRE, a threat group running Aur0ra as a closed ransomware programme.
The findings, published on 29 October 2026, connect an AI-assisted testing environment examined earlier in the year with infrastructure subsequently used for data theft and ransomware deployment. They provide evidence of AI supporting practical attack operations rather than merely producing malicious code.
Aur0ra ransomware activity linked to GOLD OGRE
Sophos found an AI-assisted post-exploitation and endpoint detection and response evasion environment in May and June 2026. Infrastructure associated with that environment later hosted Cobalt Strike components used to support Aur0ra ransomware operations.
The researchers attributed the operations to GOLD OGRE. Sophos says the group has operated Aur0ra as a closed programme since April 2026, principally targeting organisations in the United States and Western Europe.
Independent research documented an Aurora affiliate using Cursor Agent during active intrusions between 8 April and 21 May 2026. At least 10 target organisations were affected during that period. CloudSEK separately tracked more than 20 affected organisations between April and July 2026, with at least four later appearing on the Aur0ra leak site.
These figures differ between trackers because they cover different periods and evidence sources. There is also some variance over when Aur0ra was first observed, with Sophos placing activity in April 2026 while other tracking began in June 2026.
Timeline of the AI-assisted campaign
- 8 April to 21 May 2026: Cursor Agent sessions were used during live intrusions against at least 10 targets.
- April to July 2026: CloudSEK tracked more than 20 organisations affected by the same operator.
- 2 June 2026: Sophos published its initial analysis of an AI-assisted post-exploitation and EDR evasion framework.
- Late August 2026: Sophos recovered Cursor artefacts associated with Aur0ra operations and evasion testing.
- 27 August 2026: CloudSEK published its investigation into the exposed operator environment and AI-assisted planning.
- 29 October 2026: Sophos publicly linked the earlier framework and supporting infrastructure to GOLD OGRE’s Aur0ra ransomware activity.
How AI supported Aur0ra ransomware attacks
The operators used Cursor’s agentic capabilities to plan and sequence attack tasks. In observed intrusions, the AI-assisted workflow helped move from existing credentialed access to Active Directory discovery, privilege escalation, lateral movement, Domain Admin access, data staging and eventual encryption.
Operators reportedly framed requests as diagnostic work or authorised red team testing to bypass safeguards in commercial AI models. The evidence therefore indicates human-directed orchestration: attackers chose objectives and access methods, while AI helped process information, generate commands and organise the next steps.
Sophos also found Russian keyboard artefacts in operator logs. These artefacts contributed context to the investigation, but keyboard settings alone do not prove an operator’s identity, nationality or location.
Iterative testing against security products
GOLD OGRE used Cursor within a virtual machine laboratory to build, test and refine payloads. The lab included Windows Server 2022 systems running agents from Sophos, CrowdStrike and Microsoft Defender, allowing the operator to assess whether payloads would be detected.
Components examined in the lab included Cobalt Strike profiles designed to resemble legitimate web traffic, shellcode injection scripts, a command and control layer using the Telegram Bot API, and a Cloudflare Worker redirector. An Active Directory discovery panel collected results and selected subsequent actions from a predefined list before dispatching tasks to agents.
This iterative process is significant because it can shorten the time needed to adjust tooling after a detection. It does not make Aur0ra ransomware autonomous, but it gives operators a faster way to test variations and coordinate established techniques.
Tools, platforms and attack sequence
The campaign is not associated with one software vulnerability or a public proof of concept. Initial access observed in the wider GOLD OGRE activity involved stolen credentials and exposed VPN access, after which the operators used a mixture of commercial tools and legitimate system utilities.
Observed tools and techniques included:
- Cobalt Strike Beacon and ISL Light for command and control or remote access.
- SharpShares and nltest for internal reconnaissance and domain discovery.
- Pass-the-hash, Remote Desktop Protocol and SOCKS5 connections for lateral movement.
- s5cmd for transferring stolen data to S3-compatible storage before encryption.
- An Aur0ra encryptor variant capable of targeting Linux and VMware ESXi environments.
Sophos observed data staging through S3-compatible infrastructure, including a VeeamTransport S3 copy command directed to hxxp://152[.]236[.]4[.]14:54410 and a bucket path beginning s3://devhost/. This is an example from a specific observation, not a complete indicator set.
Once the operators had sufficient privileges, they staged data for exfiltration and deployed the Aur0ra encryptor. Sophos recorded dwell times ranging from 12 hours to nine days, showing that some intrusions progressed from access to impact within a relatively short window.
Current Aur0ra ransomware exploitation status
Exploitation in the wild is confirmed. Sophos observed live activity that progressed through post-exploitation, data staging and ransomware deployment, while CloudSEK documented affected organisations and subsequent leak site publication.
No specific versions of Sophos, CrowdStrike or Microsoft Defender agents were disclosed. Those products were tested as defensive controls in the operator’s Windows Server 2022 lab, rather than identified as vulnerable products. Likewise, Cursor was used as an attack support tool, not exploited through a reported software flaw.
The campaign’s concentration in Western Europe makes the activity relevant to UK organisations. Businesses using internet-exposed VPN services, weakly controlled remote access or outsourced administration may face increased risk if stolen credentials allow GOLD OGRE to begin rapid hands-on activity.
Actions tied to the GOLD OGRE campaign
Organisations should prioritise checks that address the techniques observed in this specific operation:
- Review VPN and remote access logs for unexpected credential use, unusual locations and abnormal session times.
- Monitor for SharpShares, nltest, pass-the-hash activity, unapproved ISL Light installations and suspicious Cobalt Strike behaviour.
- Restrict or alert on s5cmd and unusual transfers to S3-compatible endpoints, particularly from servers that do not normally use object storage.
- Use application control and behavioural EDR detections to identify injection, credential access and lateral movement rather than relying only on known file signatures.
- Maintain isolated, tested backups for Windows, Linux and VMware ESXi systems, with access separated from normal domain administration.
Aur0ra ransomware demonstrates how AI can accelerate familiar attack stages without replacing the human operator. Detection should therefore focus on the observable behaviour connecting credential misuse, reconnaissance, privilege escalation, exfiltration and encryption.
Originally reported by sophos.com.
