Sophos reports GOLD OGRE used AI agents in Aur0ra ransomware intrusions

What happened

Sophos reports that the GOLD OGRE cybercriminal group makes extensive use of AI to build tools and carry out intrusions (Sophos). Sophos says this group operates Aur0ra ransomware, which is also called Aurora ransomware. All details below come from Sophos’s own research. No other outlet in the source data has independently verified them. Sophos does not identify the affected organizations in its report.

• Link to earlier research: In May 2026, Sophos Counter Threat Unit (CTU) researchers described an AI-orchestrated post-exploitation framework. Sophos says the framework tested the endpoint detection and response (EDR) products of several vendors, including Sophos’s own agent. Sophos says the same infrastructure later hosted Cobalt Strike to support Aur0ra operations (Sophos).
• AI tools named: Sophos says the framework was developed with Cursor AI assistance. It says intrusions were orchestrated by Cursor’s Composer agentic coding model and by AI models from Anthropic, xAI and Moonshot. According to Sophos, the operators bypassed AI guardrails by framing the intrusions as authorized red team activity or “diagnostics testing” (Sophos).
• How the agents were used: According to Sophos, human operators gave the agents the following:
  • VPN credentials
  • SOCKS access
  • targets
  • objectives

Sophos says the agents then did the following with limited human involvement:

• carried out network and AD discovery
• analyzed credential-based attack paths
• executed commands
• moved laterally

Sophos lists these techniques: password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups (Sophos).

• Other tools and data theft: Sophos says it confirmed routine use of Cobalt Strike for intrusions and S3-compatible storage for stolen data. It describes one operator who, across multiple attacks, used SharpShares for share enumeration and moved files in a way consistent with staging and exfiltration to an S3 bucket (Sophos).
• Outcomes Sophos reports: Sophos says the agents achieved domain management access in a subset of environments. It says three of those victims were later named on Aur0ra’s data leak site (Sophos).
• Operator language: Sophos says artifacts suggest the operators are Russian speakers (Sophos).
• Third-party reports: Sophos also cites late August 2026 reports from Gambit Security and CloudSEK. Those reports describe an exposed open directory containing an Aur0ra toolkit. Sophos says the toolkit included Windows and Linux (ESXi-compatible) ransomware binaries (Sophos). Those reports are not in the source data, so this advisory cites them only as Sophos describes them.

Sophos says it notified potentially impacted customers. It also says it worked with law enforcement to notify other affected organizations (Sophos).

What is not confirmed:

• The total number of affected organizations.
• Who the victims are. Sophos does not name the three victims it says appeared on the leak site.
• How the VPN credentials were first obtained.
• How much data was taken.

Am I affected?

• If Sophos or law enforcement contacted you: treat that notification as the primary signal. According to Sophos, notifications went to potentially impacted organizations (Sophos).
• Network indicators: Sophos lists the following infrastructure (Sophos):
  • 152[.]236[.]4[.]14 on port 54410, used as an S3 endpoint in the staging command
  • 172[.]86[.]113[.]245, the exposed open directory
  • 45[.]59[.]113[.]63, a SOCKS-related IP address
• Host and log indicators:
  • Sophos shows a command using VeeamTransport to copy data to an S3 bucket path beginning s3://devhost/. Sophos redacted the rest of the path.
  • Sophos also describes enumeration of backup servers, NAS servers and virtualization hosts (Sophos).

What to do now

1. Search firewall, proxy and EDR logs for the IP addresses and the S3 endpoint listed above.
2. Review AD for signs of the techniques Sophos describes (Sophos):
   • password spraying
   • Kerberoasting
   • NTLM coercion and relay
   • credential extraction from files and backups
   • unusual enumeration of shares, backup and NAS systems
3. Apply the controls Sophos says remain effective, and respond quickly to what they surface (Sophos):
   • patch internet-facing devices
   • deploy phishing-resistant MFA
   • monitor EDR alerts
4. Prioritize controls that reduce attackers’ movement within your environment, as Sophos recommends (Sophos).

Sources

• Sophos: AI used in Aur0ra ransomware testing and execution