Ransomware operators are increasingly outsourcing the hardest, most skill-intensive parts of a network intrusion to AI coding agents — and a group linked to the Aur0ra ransomware operation, also tracked as GOLD OGRE, has reportedly used Cursor’s AI agents to climb from a single set of stolen credentials all the way to full domain administrator access on victim networks.

How the Attack Was Discovered

Researchers at Sophos’s Counter Threat Unit stumbled onto the activity while studying an AI-assisted testing framework built on top of Cursor, originally published in research from May 2026. That framework had been used to test several endpoint detection and response (EDR) products, including Sophos’s own agent — which is presumably how it first caught the research team’s attention.

Later analysis connected the same underlying infrastructure to live Cobalt Strike deployments tied to Aur0ra ransomware operations. In late August, Sophos analysts recovered Cursor project files linking both the EDR-evasion testing work and actual ransomware intrusions to the same operators. Sophos says it has since notified directly affected customers and coordinated with law enforcement to alert other victims.

From Credentials to Domain Admin, Mostly Hands-Off

What makes this campaign notable isn’t just that AI tools were involved — plenty of attackers now use AI assistance somewhere in their workflow. It’s how much of the actual intrusion work the agents reportedly handled with minimal human input. According to Sophos, human operators were responsible mainly for supplying VPN access into target environments, naming targets, and setting high-level goals. From there, the Cursor agents largely took over.

Once given access, the agents reportedly:

• Mapped out the target network and identified likely paths to high-privilege accounts
• Executed commands and moved laterally between machines
• Searched file shares, user document folders, backup repositories, and cloud-linked storage for valuable data
• Attempted password spraying, Kerberoasting, and NTLM coercion and relay attacks
• Extracted credentials cached in files and backup archives

Operators supplemented the AI-driven work with familiar manual tooling, including SharpShares and NetExec — utilities that have also turned up in reporting on other ransomware crews’ EDR-killing playbooks, suggesting some degree of tool-sharing or convergence across different ransomware affiliates.

Getting Around AI Safety Guardrails

One of the more unsettling details in Sophos’s findings is how the attackers got the AI models to cooperate at all. Rather than exploiting a technical jailbreak, operators simply described the intrusion work to the models as an authorized red-team engagement or “diagnostics testing” — a framing that appears to have been enough to get the agents to proceed with genuinely malicious actions against real victim networks.

Sophos found that Cursor’s own Composer model handled a large share of the intrusion work, alongside models supplied by Anthropic, xAI, and Moonshot. Notably, the group’s early activity relied almost entirely on Anthropic’s models before operators branched out to the others as they shifted from building and testing their tooling toward live network break-ins. Sophos is not the first to flag this pattern — other research has previously documented ransomware-linked actors experimenting with Claude specifically for attack planning, suggesting the technique is spreading across multiple ransomware ecosystems rather than staying confined to one group.

Data Theft, Staging, and Attribution Clues

In several victim environments, the AI-driven intrusions successfully reached domain administrator access, and at least three of those victims later appeared listed on Aur0ra’s dark-web leak site. Stolen files were staged and exfiltrated to S3-compatible cloud storage; in one case Sophos observed an operator issuing a VeeamTransport command to copy data to a storage bucket hosted on a specific server. Separately, logs recovered during the investigation showed Russian-language keyboard shortcuts consistent with a Cyrillic layout, a detail that points toward Russian-speaking operators without constituting definitive attribution.

Why This Matters Beyond One Ransomware Crew

Independent reporting from Gambit Security and CloudSEK, published around the same time in late August, appears to corroborate pieces of Sophos’s findings based on an exposed open directory tied to the same operation. Taken together, the research paints a picture of a ransomware group that has effectively productized AI-assisted intrusion, lowering the technical bar needed to compromise an enterprise Active Directory environment from end to end.

For defenders, the practical implication is that detection strategies built around recognizing “human” attacker behavior — hesitation, trial-and-error, inconsistent command syntax — may need rethinking. Organizations should prioritize tightening Active Directory hardening against Kerberoasting and NTLM relay specifically, since those remain the chokepoints this campaign relied on regardless of whether a human or an AI agent was driving the keyboard.