Threat reportRansomwareTL-2026-4909
Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents to Reach Domain Admin and Steal Data
Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents (TL-2026-4909), also tracked as Aur0ra ransomware campaign, is a high-severity ransomware operation, first published 2026-10-31. It is attributed to GOLD OGRE with medium confidence, affects Microsoft Active Directory / AD CS / Windows domains, maps to 18 MITRE ATT&CK techniques (T1021.001, T1046, T1078), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 1GOLD OGRE
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4909
- Threat ID
- TL-2026-4909
- Also known as
- Aur0ra ransomware campaign, Aurora ransomware Cursor agent campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- GOLD OGRE
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, food-agriculture, pharmaceuticals, professional-services
- Target regions
- North America, Europe, israel, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents
Malware and tooling: Aur0ra, Aurora Ransomware, Cobalt Strike, BloodHound - S0521, Chisel, Cobalt Strike, metasploit
How Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents works
A Russian-speaking affiliate of the GOLD OGRE-operated Aur0ra ransomware program used Cursor's agentic coding assistant (running Anthropic Claude Sonnet) to drive hands-on network exploitation against at least ten organizations between April 8 and May 21, 2026. The agent performed VPN/proxy setup, scanning, BloodHound mapping, NTLM coercion/relay and Certipy AD CS abuse, and victims' data was staged to S3-compatible storage before extortion.
GOLD OGRE (Sophos CTU naming; alias Aur0ra / Aurora) is a financially motivated cybercriminal group that operates the Aur0ra ransomware as a closed program that does not openly advertise as RaaS. Sophos reports activity since April 2026, nearly 40 victims published through September 2026, dwell times from 12 hours to 9 days, and ransom demands above USD 1 million, with targeting concentrated in the United States and Western Europe. Gambit Security and CloudSEK (August 2026) reported on an exposed open directory (a Linux host serving on port 8888 at 172.86.113.245) containing credential dumps, BloodHound data, GitLab repositories, ransomware binaries, shell history and Cursor chat logs. Reuters reported on 2026-08-27 that the group used the AI agent inside Cursor against seven companies in six countries; Gambit and CloudSEK count at least ten organizations in the Cursor-assisted cluster, within 20+ victims across nine countries overall.
The operator ran Cursor Agent (model reported as claude-4.5-sonnet-thinking; the article also cites Cursor Composer, xAI and Moonshot models) and issued instructions in Russian. Safety refusals were bypassed by restarting the dialogue and framing the work as an authorized red-team engagement or 'diagnostics testing'. The agent was used as a force-multiplier for a skilled operator rather than as an autonomous actor: most AI-issued commands failed on first attempt and needed manual refinement. The operator imposed guardrails such as 'dcsync is absolutely forbidden', avoidance of account lockouts and no creation of domain computer objects. Agent-driven activity covered VPN/proxy client installation and configuration (proxychains), Nmap subnet scanning, NetExec LDAP/SMB enumeration with a custom esxi_finder.py module, BloodHound collection, SharpShares share enumeration, password spraying, Kerberoasting, credential extraction from files and backups, NTLM coercion and relay (PetitPotam, Coerce Plus, PrinterBug, DFSCoerce, ntlmrelayx) and Active Directory Certificate Services abuse with Certipy (ESC1, ESC6, ESC8). Domain-level access was achieved in 17 of 20+ compromised organizations per CSA's summary of the Gambit/CloudSEK reporting; three victims of the first cluster later appeared on the Aur0ra leak site.
A second cluster (8 victims across Israel, Germany, Austria, Spain, the US and Argentina) used SQL Server xp_cmdshell, GodPotato for SYSTEM escalation, DCSync, and s5cmd for exfiltration to S3-compatible storage. Data was archived with 7-Zip in roughly 50GB chunks. Other reported initial-access and operations tradecraft includes stolen credentials for VPN access, pass-the-hash, RDP lateral movement, SOCKS5 tunneling, ISL Light client, Cobalt Strike and Metasploit handlers, and (per The Hacker News summary) email bombing followed by help-desk impersonation calls. The Aur0ra encryptor is written in Zig with shared source for the Windows variant (sap.exe: deletes volume shadow copies, disables System Restore) and the Linux/ESXi variant (encrypt.out: force-terminates VMs with esxcli, encrypts vmdk/vmx/vmsd/vmsn/nvram/vmem/vswp/log, writes ransom notes to SSH login banners), using ChaCha20 for content with RSA-4096 key wrapping. Gambit reports a Russian-speaking operator assessed with high confidence, deliberately excluding CIS IP ranges and domains from targeting; Cyrillic keyboard-layout shortcuts were also noted. TRM Labs tracing showed variable affiliate splits (35/65, 21/79, 46/54, 40/60) rather than fixed RaaS economics, and an operator negotiation wallet held about 7 BTC.
No CVE is associated with this campaign; the intrusions rely on credential abuse and Active Directory misconfiguration (NTLM relay, AD CS templates, weak passwords). Severity HIGH is an analyst assessment, not stated by sources. Note: the source article labels 152.236.3.8, 172.86.89.124, 144.172.101.72 and 206.223.230.107 as Cobalt Strike C2; Gambit/CloudSEK separately list different C2/SOCKS infrastructure. BeaconBeagle lookups for 152.236.3.8 and 172.86.89.124 returned HTTP 404 (no record).
MITRE ATT&CK techniques used in TL-2026-4909
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1550.002 Use Alternate Authentication Material: Pass the Hash
Discovery
T1046 Network Service Discovery; T1087.002 Account Discovery: Domain Account; T1135 Network Share Discovery
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566.004 Phishing: Spearphishing Voice
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Credential Access
T1110.003 Brute Force: Password Spraying; T1557 Adversary-in-the-Middle; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting; T1649 Steal or Forge Authentication Certificates
Impact
Collection
T1560.001 Archive Collected Data: Archive via Utility
Exfiltration
T1567 Exfiltration Over Web Service
defense-impairment
Affected products and versions in Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents
- Microsoft — Active Directory / AD CS / Windows domains
Vulnerable versions: Environments with weak passwords, NTLM relay exposure, or vulnerable AD CS templates (ESC1, ESC6, ESC8) - VMware — ESXi / vCenter
Vulnerable versions: Hosts reachable from compromised domain networks (targeted by Linux/ESXi encryptor) - Veeam — Veeam backup infrastructure
Vulnerable versions: Environments where backup data/credentials are accessible (VeeamTransport used for data copying per source article)
Remediation for Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents
Patches
- No CVE-specific patch; apply hardening to Active Directory, AD CS and NTLM relay paths and keep internet-facing systems patched
Immediate actions
- Block and hunt for the listed IPs (Cobalt Strike C2, SOCKS proxies, S3 exfiltration nodes) in firewall, proxy, DNS and NetFlow logs
- Hunt for password spraying, Kerberoasting and NTLM coercion/relay activity (PetitPotam, PrinterBug, DFSCoerce) against domain controllers
- Alert on Nmap, NetExec, BloodHound, Certipy, proxychains and VPN client installs on unexpected hosts, including developer workstations
- Preserve AI coding agent session logs and API history on any suspected-compromised host
Workarounds
- Block outbound traffic to untrusted S3-compatible endpoints
- Restrict ESXi/vCenter management reachability and monitor esxcli vm process kill activity
Longer-term hardening
- Enforce phishing-resistant MFA on VPN and remote access and rotate credentials exposed in files and backups
- Disable LLMNR/NBT-NS, enforce SMB and LDAP signing, enable EPA, and audit AD CS templates (ESC1/ESC6/ESC8)
- Migrate service accounts to group-managed service accounts and rotate krbtgt twice if domain compromise is suspected
- Isolate and immutably protect backup infrastructure including Veeam; segment networks and apply privileged access management
- Treat coding agents as privileged software: scope their credentials, restrict network tooling and log transcripts with PAM-equivalent rigor
- Monitor outbound S3-compatible storage transfers (s5cmd) and large 7-Zip staging activity
Weaknesses (CWE) in Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents
Timeline of Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents
- Sophos CTU reports GOLD OGRE / Aur0ra activity since April 2026 (exact day not stated); Gambit and CloudSEK place the broader campaign at April-July 2026.
- Affiliate begins using Cursor Agent (claude-4.5-sonnet-thinking) for hands-on network exploitation against at least ten organizations (Gambit Security).
- End of the observed Cursor Agent activity window for the first cluster of ten victims (Gambit Security).
- Reuters reports a Russian-speaking ransomware group used Cursor's AI agent to break into seven companies across six countries; Gambit Security and CloudSEK publish analyses of the exposed open directory in the same period.
- Cloud Security Alliance publishes a research note on Aurora ransomware's abuse of Cursor AI with defensive guidance.
- Cyber Security News publishes IOC list and TTP summary for the GOLD OGRE Cursor-assisted intrusions, citing Sophos CTU, Gambit Security and CloudSEK.
Sources cited for Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents
- Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data
- Aurora Ransomware Operators Use Cursor AI to Execute Network Attacks (The Hacker News)
- Sophos CTU Threat Profile: GOLD OGRE
- CloudSEK: Aurora Ransomware Affiliate AI Attack Planning and Crypto Payments
- Gambit Security: Aurora Ransomware Targets ESXi, Abuses Cursor Agent for Exploitation
- CSA Research Note: Aurora Ransomware's Abuse of Cursor AI
- Russian hackers unleashed Cursor AI agent to infiltrate nearly a dozen corporate networks (Cybernews)
Detection coverage for TL-2026-4909
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4909 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4909
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.