# GOLD OGRE

> As of 2026-10-31, GOLD OGRE is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware. ATT&CK coverage spans 29 techniques across 13 tactics in 2 of 2 tracked threats. Most-observed techniques: T1021.001 (Remote Desktop Protocol), T1078 (Valid Accounts), T1087.002 (Account Discovery: Domain Account).

- **Tracked threats:** 2
- **Categories:** RANSOMWARE
- **As of:** 2026-10-31

## ATT&CK techniques observed

29 techniques observed across 2 of 2 tracked threats. Tactics: Credential Access (5), Discovery (5), Lateral Movement (4), Initial Access (3), Command and Control (2), Defense Impairment (2).

- [T1021.001](https://intel.threadlinqs.com/technique/T1021.001) Remote Desktop Protocol — Lateral Movement — observed in 2 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1087.002](https://intel.threadlinqs.com/technique/T1087.002) Account Discovery: Domain Account — Discovery — observed in 2 of 2 tracked threats
- [T1090](https://intel.threadlinqs.com/technique/T1090) Proxy — Command and Control — observed in 2 of 2 tracked threats
- [T1110.003](https://intel.threadlinqs.com/technique/T1110.003) Password Spraying — Credential Access — observed in 2 of 2 tracked threats
- [T1133](https://intel.threadlinqs.com/technique/T1133) External Remote Services — Initial Access — observed in 2 of 2 tracked threats
- [T1135](https://intel.threadlinqs.com/technique/T1135) Network Share Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1550.002](https://intel.threadlinqs.com/technique/T1550.002) Use Alternate Authentication Material: Pass the Hash — Lateral Movement — observed in 2 of 2 tracked threats
- [T1558.003](https://intel.threadlinqs.com/technique/T1558.003) Kerberoasting — Credential Access — observed in 2 of 2 tracked threats
- [T1560.001](https://intel.threadlinqs.com/technique/T1560.001) Archive via Utility — Collection — observed in 2 of 2 tracked threats
- [T1566.004](https://intel.threadlinqs.com/technique/T1566.004) Spearphishing Voice — Initial Access — observed in 2 of 2 tracked threats
- [T1572](https://intel.threadlinqs.com/technique/T1572) Protocol Tunneling — Command and Control — observed in 2 of 2 tracked threats
- [T1649](https://intel.threadlinqs.com/technique/T1649) Steal or Forge Authentication Certificates — Credential Access — observed in 2 of 2 tracked threats
- [T1685](https://intel.threadlinqs.com/technique/T1685) Disable or Modify Tools — Defense Impairment — observed in 2 of 2 tracked threats
- [T1018](https://intel.threadlinqs.com/technique/T1018) Remote System Discovery — Discovery — observed in 1 of 2 tracked threats

## Tracked threats

- [Aur0ra Ransomware Operations Use Cursor and Claude AI to Automate Attacks (GOLD OGRE)](https://intel.threadlinqs.com/threat/TL-2026-4921) — HIGH
- [Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents to Reach Domain Admin and Steal Data](https://intel.threadlinqs.com/threat/TL-2026-4909) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/GOLD%20OGRE