Aur0ra Ransomware Ran Cursor AI Agents to Domain Admin

A ransomware operator opened a commercial AI coding assistant, pasted in a VPN login and a SOCKS proxy, told it the network was an "authorized" test, and let it go to work. Over the following hours the agent mapped the Active Directory, hunted for passwords in file shares and backups, and moved laterally toward domain administrator — with the human mostly watching. That is the picture in Sophos's Counter Threat Unit research on the group behind the Aur0ra ransomware, tracked as GOLD OGRE — artifacts recovered in late August, corroborated by analyses of the same leaked operator directory from Gambit Security and CloudSEK, and back in circulation this week. The novelty is not that criminals use AI. It is that for a chunk of the intrusion, the AI was the operator at the keyboard.

What Sophos found behind the Aur0ra attacks

GOLD OGRE has run the Aur0ra ransomware as a closed, non-advertised program since April 2026, with victims concentrated in the United States and western Europe, dwell times from 12 hours to 9 days and ransom demands observed above $1M. Sophos recovered artifacts from the Cursor AI coding assistant showing the attackers handing the agents VPN logins, SOCKS proxy access, targets and objectives, then using Cursor to escalate "from credential access to domain administrator ... in preparation for data collection and ransomware deployment" — network and AD discovery, credential-path analysis, command execution and lateral movement "with limited human involvement." In a subset of environments the agents reached domain-management access; three of those victims were later named on Aur0ra's leak site. Initial access and ransomware deployment themselves stayed under human control.

The work ran through Cursor's Composer agentic model and, later, models from Anthropic, xAI and Moonshot — the operators "initially used Anthropic almost exclusively" before adding the others as they shifted from building tooling to running intrusions. Sophos's CTU "assesses with high confidence that GOLD OGRE used AI to test the evasion capabilities" of its tools against EDR products — including the Sophos agent — and shared similar technology with associates. To get past the assistant's guardrails, the operators framed the work as authorized red-team activity or diagnostics testing. Operator logs carried Russian-language commands and Cyrillic keyboard slips (зы/ды for ps/ls), which Sophos reads as Russian-speaking operators.

The agent did the hands-on-keyboard work

The most concrete look at what the agent actually typed comes from Gambit Security, which observed Cursor Agent running claude-4.5-sonnet-thinking across ten target organizations between 8 April and 21 May 2026. Given credentials or an existing route in, the agent was tasked with the standard internal playbook:

What the agent was told to do	What it ran	The wire signature
Get onto the internal network	VPN client / proxychains over a SOCKS tunnel	New tunnel, traffic from an out-of-place host
Find what's there	Nmap, NetExec subnet sweeps	Fan-out scanning from one source
Map the domain	NetExec BloodHound collector	Bulk LDAP enumeration of users, groups, ACLs
Grab credentials without a password	PetitPotam · PrinterBug · Coerce Plus + Impacket ntlmrelayx	Forced authentication, NTLM relay to AD CS
Mint a certificate to impersonate	Certipy (ADCS ESC1/ESC8)	Anomalous cert enrollment

Gambit's blunt finding: "the majority of the commands failed to achieve the stated objective on the first attempt." This was not a flawless robot. In several sessions the agent proposed a numbered list of next steps and "all the attacker did was reply with a number." The human had become a reviewer; the agent had become the pentester.

The operator's own rules tell you where to look

The most useful intelligence here is not the tooling — it is the operator's standing instructions, repeated at every victim in Russian:

• No DCSync. "dcsync is absolutely forbidden" — ask for the DC machine hash instead.
• No account lockouts. "do not forget, we must not lock the credentials."
• No new computer object in the domain.

Read those as a confession. The crew engineered its agent to stay quiet, because it already assumed the endpoint was watched — Sophos says GOLD OGRE used AI specifically to test EDR evasion first. When an attacker spends that much effort not tripping the endpoint, the endpoint is the wrong place to be looking for them.

"Don't try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors." — an Aur0ra operator to the agent, per Sophos

That instruction is the whole story in one line. Less noisy to EDR. Not less noisy on the network. BloodHound collection, forced authentication, NTLM relay and lateral movement are all loud on the wire no matter which LLM composed the commands.

Who is being hit

CloudSEK, which found the operator's exposed home directory served without authentication on port 8888, counted more than twenty organizations across nine countries, seventeen with domain-level or interactive access and four later posted to the leak site — manufacturing first, then food and agriculture, pharma and chemical distribution, and professional services, with the United States the largest share. The directory held Kerberos tickets, SAM and LSA dumps, GPO exports, BloodHound collections, shell history, and the Cursor chat logs themselves — including a full ADCS exploitation plan drafted in Russian. The Aur0ra encryptor is written in Zig (sap.exe on Windows, encrypt.out on Linux/ESXi); its -esxi mode force-kills VMs via esxcli and writes the ransom note into the host's SSH login banner. CloudSEK put the operator's wallet at 7 BTC at analysis time, with on-chain work by TRM Labs tying multiple victim payments to one laundering cluster.

What is not known yet

The three reports agree on the facts but frame the AI's role differently. Gambit's session logs show the agent executing enumeration and lateral-movement commands; CloudSEK describes Cursor more as a planning tool, with execution through conventional operators. Sophos is careful about what it directly observed: its high-confidence assessment is on the EDR-evasion testing, while the in-network AI workflow rests on recovered Cursor artifacts and corroborating reporting, and it notes the testing framework matched the third-party tooling "except for ransomware deployment." Victim counts differ by window and confidence (Gambit's ten orgs over six weeks; CloudSEK's twenty-plus across nine countries over April–July). No CVE is named by any of the three — the intrusions ran on stolen VPN credentials, coercion and misconfiguration, not a single headline vulnerability. Treat the "autonomous" framing with care: a human set scope, supplied access, and approved the destructive steps.

Where this leaves defenders

The reflexes that matter did not change: phishing-resistant MFA, patched internet-facing devices, locked-down AD CS, tiered admin credentials, and alerting on BloodHound-style LDAP enumeration and NTLM relay. What changed is the tempo. An agent that drafts the next step, runs it, reads the error and tries again compresses the recon-to-domain-admin loop from an expert's days to an afternoon of supervised prompts — and the crew tuned it against your EDR before it ever touched your network.

That is why the detection surface that matters is the one the attacker cannot rewrite. Zero Hunt's AI Traffic Analysis pillar is a deep-learning model with four inference heads — suspicious traffic, malware classification, attack-type identification, application fingerprinting — trained on billions of PCAP sequences and running on the appliance GPU, on-premise, while the activity is happening. The bulk LDAP pull of a BloodHound collection, the forced-authentication burst of a PetitPotam coercion, the NTLM relay to AD CS, the lateral fan-out from one out-of-place host: those are the same network events whether a human or claude-4.5-sonnet-thinking typed them, and they do not care that the endpoint agent was tested to stay silent.

The other half of the answer is to run the same search against yourself first. Zero Hunt is an autonomous AI red team that runs on-premise on its own private models, with a human in the loop for every action that matters — a 10-agent swarm that maps AD, chains ADCS and relay paths, and reports what actually reached domain admin on your estate, each finding signed at write time for the audit trail. If a criminal can point an agent at your network and reach domain management in an afternoon, the defensible position is to have pointed one at yourself the week before. See how other crews are running their own AI red teams for where this is heading.