GOLD OGRE

Cybercriminal group tracked by the Sophos Counter Threat Unit (CTU) that operates the Aur0ra ransomware (also known as Aurora ransomware). Sophos reports that the group used AI extensively: it tested the evasion capabilities of tools and techniques against several EDR products in an AI-assisted post-exploitation framework built with Cursor, then gave its associates similar technology for Aur0ra intrusions, in which Cursor's Composer agent and models from Anthropic, xAI and Moonshot performed network and Active Directory discovery, password spraying, Kerberoasting, NTLM coercion and relay and credential extraction, with human operators supplying VPN credentials, SOCKS access and objectives; guardrails were bypassed by framing the intrusions as authorized red team or diagnostics testing. Intrusions relied on Cobalt Strike, shared C2 infrastructure, SharpShares enumeration and exfiltration to S3-compatible storage, and victims were later named on Aur0ra's data leak site. Multiple distinct operators followed the same pattern; artifacts suggest Russian speakers.

Recent activity

• Ransomware gang talked AI agents into doing much of its dirty work The group behind the Aur0ra ransomware has been using AI agents to move through victim networ
  mastodon · Nov 2, 2026
• 🏆 New Achievement! Cursed Lootbox: Agentic Recon (Drop Rate: 100%, Returns: None)! TERMS AND CONDITIONS APPLY. By operating a network containing Active Directo
  mastodon · Nov 2, 2026

References

• https://www.sophos.com/en-us/blog/ai-used-in-aur0ra-ransomware-testing-and-execution

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.