Threat reportRansomwareTL-2026-4921
Aur0ra Ransomware Operations Use Cursor and Claude AI to Automate Attacks (GOLD OGRE)
Aur0ra Ransomware Operations Use Cursor and Claude AI to (TL-2026-4921), also tracked as Aur0ra ransomware, is a high-severity ransomware operation, first published 2026-10-31. It is attributed to GOLD OGRE with medium confidence, affects Microsoft Windows Active Directory / AD CS environments, maps to 25 MITRE ATT&CK techniques (T1018, T1021.001, T1021.002), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 1GOLD OGRE
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-4921
- Threat ID
- TL-2026-4921
- Also known as
- Aur0ra ransomware, Aurora ransomware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- GOLD OGRE
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, food-and-agriculture, pharmaceuticals, professional-services, title-and-legal
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Aur0ra Ransomware Operations Use Cursor and Claude AI to
Malware and tooling: Aur0ra, Aurora Ransomware, Cobalt Strike, BloodHound - S0521, Certipy, Cobalt Strike, ISL Light, Impacket - S0357, PetitPotam, Xray-core, s5cmd
How Aur0ra Ransomware Operations Use Cursor and Claude AI to works
GOLD OGRE, a financially motivated and assessed Russian-speaking cybercrime group, operates the closed-program Aur0ra ransomware and used the Cursor AI coding agent (backed by Anthropic Claude Sonnet) to plan and run Active Directory discovery, credential attacks, NTLM relay, AD CS abuse and S3-compatible exfiltration. Sophos CTU, CloudSEK and Gambit Security document a multi-victim operation spanning 20+ organizations in nine countries, with human operators supervising the AI agent.
Aur0ra (also written Aurora) ransomware is operated by the group Sophos tracks as GOLD OGRE. Sophos describes it as a closed program rather than an openly advertised RaaS. It has been active since roughly April 2026, with about 40 published victims through September 2026 according to Sophos. Victims are concentrated in the United States and Western Europe, dwell time ranges from 12 hours to 9 days (about 12 days from intrusion to leak-site post per Black Hills InfoSec), and ransom demands have exceeded USD 1 million.
Initial access is reported in two forms. Sophos documents the use of stolen credentials against internet-exposed VPN services. Black Hills InfoSec and the CloudSEK-based reporting describe email-bombing followed by vishing calls that impersonate IT help desk staff, with Xray-core (VLESS/REALITY, masqueraded as ChromeUpdate.exe and ConnectivityHost.exe) used for command and control and proxying. Persistence and lateral movement use Cobalt Strike Beacon, ISL Light, pass-the-hash, RDP, WinRM, SMB, LDAP and SOCKS5 proxying. Reconnaissance uses SharpShares, nltest, Nmap, NetExec and BloodHound. Privilege escalation and lateral movement include NTLM coercion and relay (PetitPotam, Coerce Plus, PrinterBug, Impacket ntlmrelayx), Kerberoasting, and Active Directory Certificate Services abuse with Certipy (ESC1, ESC6 and ESC8 referenced). GodPotato was also observed.
AI use is the distinguishing feature. Gambit Security recovered 28 Cursor chat sessions covering ten target organizations between April 8 and May 21, 2026. CloudSEK analyzed an exposed open directory with shell history covering April to July 2026 and 20+ organizations in nine countries. Operators wrote instructions to the Cursor agent in Russian, excluded CIS ranges and domains, and forbade noisy actions such as DCSync, account lockouts and brute-forcing. Most AI-issued commands failed on the first attempt and needed manual refinement, so the activity was human-supervised rather than autonomous. Per the GBHackers summary of Sophos CTU research, operators first relied almost entirely on Anthropic models, then added xAI and Moonshot models. Humans supplied VPN credentials, SOCKS access, targets and objectives, and the agents ran AD discovery, analyzed credential attack paths and moved laterally, prioritizing backup servers, NAS and virtualization hosts.
Data is staged with PowerShell-driven 7-Zip archiving (reported in 50 GB chunks) and exfiltrated to S3-compatible storage with s5cmd (a VeeamTransport-named binary was also used for S3 copying). SQL Server xp_cmdshell abuse was reported. The Windows locker (sap.exe in CloudSEK reporting) deletes shadow copies, disables System Restore and encrypts files in place without changing extensions, dropping !!!README!!!DO_NOT_DELETE.txt. The Linux/ESXi variant (encrypt.out) force-kills VMs with esxcli and encrypts VM disk and state files. Reporting on the cryptography differs between sources: CloudSEK-based reporting cites ChaCha20 with RSA-4096 key wrapping and a Zig codebase, while Cohesity cites the Windows CryptoAPI. Treat the algorithm details as unreconciled.
No CVEs are associated with this threat. Victim counts differ by source and date (3 in the GBHackers article, 4 leak-site victims in THN/CloudSEK, 28 per Ransomware.live via Black Hills, about 40 per Sophos). Severity HIGH is an analyst assignment. BeaconBeagle lookups for the three article IPs returned HTTP 404 (no C2 record).
MITRE ATT&CK techniques used in TL-2026-4921
Discovery
T1018 Remote System Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1135 Network Share Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.006 Remote Services: Windows Remote Management; T1550.002 Use Alternate Authentication Material: Pass the Hash
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Defense Evasion
T1055.012 Process Injection: Process Hollowing; T1070.006 Indicator Removal: Timestomp
Execution
T1059.001 Command and Scripting Interpreter: PowerShell
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566.004 Phishing: Spearphishing Voice
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Credential Access
T1110.003 Brute Force: Password Spraying; T1557.001 Name Resolution Poisoning and SMB Relay; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting; T1649 Steal or Forge Authentication Certificates
Privilege Escalation
T1134.001 Access Token Manipulation: Token Impersonation/Theft
Collection
T1560.001 Archive Collected Data: Archive via Utility
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in Aur0ra Ransomware Operations Use Cursor and Claude AI to
- Microsoft — Windows Active Directory / AD CS environments
Vulnerable versions: Misconfigured AD CS templates (ESC1, ESC6, ESC8); Domains without SMB signing or with NTLM relay exposure - VMware — ESXi / vCenter
Vulnerable versions: Hosts reachable from compromised enterprise networks - Veeam and other backup platforms — Backup servers and NAS
Vulnerable versions: Backups not isolated from domain credentials
Remediation for Aur0ra Ransomware Operations Use Cursor and Claude AI to
Patches
- No CVEs are associated with this threat; patch internet-facing devices as general hygiene
Immediate actions
- Block and hunt for 152.236.4.14, 45.59.113.63, 172.86.113.245, 172.86.116.200 and 151.244.30.43 in network telemetry
- Hunt for sap.exe, encrypt.out, ChromeUpdate.exe, ConnectivityHost.exe and !!!README!!!DO_NOT_DELETE.txt
- Alert on vssadmin delete shadows, wmic shadowcopy delete and schtasks disabling the SystemRestore task in quick succession
- Audit outbound connections for tunneling tools (VPN clients, proxychains, Xray-core) and s5cmd or S3-compatible uploads
- Preserve AI coding-assistant session logs and API request history if unauthorized use is found
Workarounds
- Rotate credentials exposed to VPN and help-desk social engineering
- Rotate the krbtgt password twice after domain compromise
Longer-term hardening
- Deploy phishing-resistant MFA on VPN and remote access
- Segment critical servers and isolate backups and ESXi/vCenter on separate credentials and networks
- Review domain admin privileges and implement privileged access management
- Remove SPNs from privileged accounts and migrate to group-managed service accounts
- Disable LLMNR and NBT-NS, enforce SMB signing, restrict WinRM
- Audit AD CS templates for ESC1, ESC6 and ESC8 misconfigurations
- Monitor EDR alerts with rapid response and deploy application controls
- Treat commercial coding agents as privileged software and scope their credentials to the minimum
Timeline of Aur0ra Ransomware Operations Use Cursor and Claude AI to
- Start of the window (April 8 to May 21, 2026) covered by 28 recovered Cursor agent chat sessions across ten victim organizations, per Gambit Security.
- Aur0ra ransomware group first reported at the end of April 2026 (Black Hills InfoSec); Sophos says GOLD OGRE has been active since April 2026.
- End of the Gambit-observed window of Cursor-assisted exploitation against ten organizations.
- Sophos CTU identified the AI-assisted post-exploitation framework in May 2026 (month per GBHackers); a CYFIRMA weekly report dated 2026-05-22 also appears in search results for Aur0ra and GOLD OGRE.
- CloudSEK's analysis of an exposed open directory (shell history) covers April to July 2026 activity against 20+ organizations in nine countries.
- CloudSEK and Gambit Security findings on infrastructure exposure and Cursor use published, covered by The Hacker News in late August 2026.
- Cloud Security Alliance published a research note on the Aurora ransomware abuse of Cursor AI.
- GBHackers reported that GOLD OGRE used Cursor and Claude to automate Aur0ra operations, with three victims on the leak site and IOCs listed.
Sources cited for Aur0ra Ransomware Operations Use Cursor and Claude AI to
- Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations
- Sophos Threat Profile: GOLD OGRE
- Aurora Ransomware Operators Use Cursor (The Hacker News)
- CSA Research Note: Aurora Ransomware's Abuse of Cursor AI
- Cohesity Red Lab: Aur0ra Ransomware Silent Encryption
- Black Hills InfoSec: Introducing the Aur0ra Ransomware Group
- UVCyber Threat Advisory: Aurora Ransomware
- WatchGuard Ransomware Tracker: Aur0ra
Detection coverage for TL-2026-4921
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4921 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.