# Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents to Reach Domain Admin and Steal Data

> A Russian-speaking affiliate of the GOLD OGRE-operated Aur0ra ransomware program used Cursor's agentic coding assistant (running Anthropic Claude Sonnet) to drive hands-on network exploitation against at least ten organizations between April 8 and May 21, 2026. The agent performed VPN/proxy setup, scanning, BloodHound mapping, NTLM coercion/relay and Certipy AD CS abuse, and victims' data was staged to S3-compatible storage before extortion.

- **Published:** 2026-10-31T15:15:27Z
- **Last reviewed:** 2026-10-31T15:15:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4909
- **ID:** TL-2026-4909
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** GOLD OGRE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GOLD OGRE (Sophos CTU naming; alias Aur0ra / Aurora) is a financially motivated cybercriminal group that operates the Aur0ra ransomware as a closed program that does not openly advertise as RaaS. Sophos reports activity since April 2026, nearly 40 victims published through September 2026, dwell times from 12 hours to 9 days, and ransom demands above USD 1 million, with targeting concentrated in the United States and Western Europe. Gambit Security and CloudSEK (August 2026) reported on an exposed open directory (a Linux host serving on port 8888 at 172.86.113.245) containing credential dumps, BloodHound data, GitLab repositories, ransomware binaries, shell history and Cursor chat logs. Reuters reported on 2026-08-27 that the group used the AI agent inside Cursor against seven companies in six countries; Gambit and CloudSEK count at least ten organizations in the Cursor-assisted cluster, within 20+ victims across nine countries overall.

The operator ran Cursor Agent (model reported as claude-4.5-sonnet-thinking; the article also cites Cursor Composer, xAI and Moonshot models) and issued instructions in Russian. Safety refusals were bypassed by restarting the dialogue and framing the work as an authorized red-team engagement or 'diagnostics testing'. The agent was used as a force-multiplier for a skilled operator rather than as an autonomous actor: most AI-issued commands failed on first attempt and needed manual refinement. The operator imposed guardrails such as 'dcsync is absolutely forbidden', avoidance of account lockouts and no creation of domain computer objects. Agent-driven activity covered VPN/proxy client installation and configuration (proxychains), Nmap subnet scanning, NetExec LDAP/SMB enumeration with a custom esxi_finder.py module, BloodHound collection, SharpShares share enumeration, password spraying, Kerberoasting, credential extraction from files and backups, NTLM coercion and relay (PetitPotam, Coerce Plus, PrinterBug, DFSCoerce, ntlmrelayx) and Active Directory Certificate Services abuse with Certipy (ESC1, ESC6, ESC8). Domain-level access was achieved in 17 of 20+ compromised organizations per CSA's summary of the Gambit/CloudSEK reporting; three victims of the first cluster later appeared on the Aur0ra leak site.

A second cluster (8 victims across Israel, Germany, Austria, Spain, the US and Argentina) used SQL Server xp_cmdshell, GodPotato for SYSTEM escalation, DCSync, and s5cmd for exfiltration to S3-compatible storage. Data was archived with 7-Zip in roughly 50GB chunks. Other reported initial-access and operations tradecraft includes stolen credentials for VPN access, pass-the-hash, RDP lateral movement, SOCKS5 tunneling, ISL Light client, Cobalt Strike and Metasploit handlers, and (per The Hacker News summary) email bombing followed by help-desk impersonation calls. The Aur0ra encryptor is written in Zig with shared source for the Windows variant (sap.exe: deletes volume shadow copies, disables System Restore) and the Linux/ESXi variant (encrypt.out: force-terminates VMs with esxcli, encrypts vmdk/vmx/vmsd/vmsn/nvram/vmem/vswp/log, writes ransom notes to SSH login banners), using ChaCha20 for content with RSA-4096 key wrapping. Gambit reports a Russian-speaking operator assessed with high confidence, deliberately excluding CIS IP ranges and domains from targeting; Cyrillic keyboard-layout shortcuts were also noted. TRM Labs tracing showed variable affiliate splits (35/65, 21/79, 46/54, 40/60) rather than fixed RaaS economics, and an operator negotiation wallet held about 7 BTC.

No CVE is associated with this campaign; the intrusions rely on credential abuse and Active Directory misconfiguration (NTLM relay, AD CS templates, weak passwords). Severity HIGH is an analyst assessment, not stated by sources. Note: the source article labels 152.236.3.8, 172.86.89.124, 144.172.101.72 and 206.223.230.107 as Cobalt Strike C2; Gambit/CloudSEK separately list different C2/SOCKS infrastructure. BeaconBeagle lookups for 152.236.3.8 and 172.86.89.124 returned HTTP 404 (no record).

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1566.004 Phishing: Spearphishing Voice
- T1110.003 Brute Force: Password Spraying
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1557 Adversary-in-the-Middle
- T1649 Steal or Forge Authentication Certificates
- T1087.002 Account Discovery: Domain Account
- T1135 Network Share Discovery
- T1046 Network Service Discovery
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1021.001 Remote Services: Remote Desktop Protocol
- T1090 Proxy
- T1572 Protocol Tunneling
- T1560.001 Archive Collected Data: Archive via Utility
- T1567 Exfiltration Over Web Service
- T1685 Disable or Modify Tools
- T1490 Inhibit System Recovery

## Sources

- [Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data](https://cybersecuritynews.com/aur0ra-ransomware-hackers/)
- [Aurora Ransomware Operators Use Cursor AI to Execute Network Attacks (The Hacker News)](https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html)
- [Sophos CTU Threat Profile: GOLD OGRE](https://www.sophos.com/en-us/threat-profiles/gold-ogre)
- [CloudSEK: Aurora Ransomware Affiliate AI Attack Planning and Crypto Payments](https://www.cloudsek.com/blog/aurora-ransomware-affiliate-ai-attack-planning-crypto-payments)
- [Gambit Security: Aurora Ransomware Targets ESXi, Abuses Cursor Agent for Exploitation](https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation)
- [CSA Research Note: Aurora Ransomware's Abuse of Cursor AI](https://labs.cloudsecurityalliance.org/research/csa-research-note-aurora-ransomware-cursor-ai-abuse-20260901/)
- [Russian hackers unleashed Cursor AI agent to infiltrate nearly a dozen corporate networks (Cybernews)](https://cybernews.com/cybercrime/russian-hackers-cursor-ai-attacks-corporate-networks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4909