Aur0ra ransomware: AI coding agents (Cursor, Claude) used to reach domain admin (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-10-29
Sophos, tracking the group as GOLD OGRE (operator of Aur0ra ransomware), reports that the group used AI coding agents in intrusions. Sophos recovered Cursor artifacts in late August 2026 tied to Aur0ra operations and to an EDR-evasion testing framework. Its workflow description has human operators giving the agents VPN credentials, SOCKS access, targets and objectives; the agents then ran network and Active Directory discovery, searched shares, user documents and backups for credentials, and moved laterally with limited human involvement. In a subset of environments the agents achieved domain management access; Sophos gives no count of those environments and says three of these victims were later named on the Aur0ra leak site. To get past model guardrails, the operators framed the work as authorized red team activity or 'diagnostics testing'. Intrusions ran on Cursor's Composer agentic coding model and on models from Anthropic, xAI and Moonshot; Sophos says the actors used Anthropic almost exclusively at first. Operator prompts were written in Russian, and some commands were typed with a Cyrillic keyboard layout. Gaining access and deploying ransomware stayed under human control. Gambit Security and CloudSEK published related analyses on 2026-08-27 that appear to draw on the same exposed open directory. No CVE or product flaw is involved. Sophos's recommendations are to patch internet-facing devices, enforce phishing-resistant MFA, monitor EDR alerts with a fast response, and limit attacker movement through segmentation, backup isolation, domain admin review, PAM and application control.
What to do
- Patch internet-facing devices and enforce phishing-resistant MFA (Sophos's existing-control recommendations)
- Monitor EDR alerts and be ready to respond quickly; Sophos says a quick response is what makes defence work
- Segment critical servers, isolate backups, review domain administrator privileges, use privileged access management, and implement application controls to limit attacker movement (Sophos)
Sources
All live incidents on Threat Watch
