# Aur0ra Ransomware Operations Use Cursor and Claude AI to Automate Attacks (GOLD OGRE)

> GOLD OGRE, a financially motivated and assessed Russian-speaking cybercrime group, operates the closed-program Aur0ra ransomware and used the Cursor AI coding agent (backed by Anthropic Claude Sonnet) to plan and run Active Directory discovery, credential attacks, NTLM relay, AD CS abuse and S3-compatible exfiltration. Sophos CTU, CloudSEK and Gambit Security document a multi-victim operation spanning 20+ organizations in nine countries, with human operators supervising the AI agent.

- **Published:** 2026-10-31T18:28:11Z
- **Last reviewed:** 2026-10-31T18:28:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4921
- **ID:** TL-2026-4921
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** GOLD OGRE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Aur0ra (also written Aurora) ransomware is operated by the group Sophos tracks as GOLD OGRE. Sophos describes it as a closed program rather than an openly advertised RaaS. It has been active since roughly April 2026, with about 40 published victims through September 2026 according to Sophos. Victims are concentrated in the United States and Western Europe, dwell time ranges from 12 hours to 9 days (about 12 days from intrusion to leak-site post per Black Hills InfoSec), and ransom demands have exceeded USD 1 million.

Initial access is reported in two forms. Sophos documents the use of stolen credentials against internet-exposed VPN services. Black Hills InfoSec and the CloudSEK-based reporting describe email-bombing followed by vishing calls that impersonate IT help desk staff, with Xray-core (VLESS/REALITY, masqueraded as ChromeUpdate.exe and ConnectivityHost.exe) used for command and control and proxying. Persistence and lateral movement use Cobalt Strike Beacon, ISL Light, pass-the-hash, RDP, WinRM, SMB, LDAP and SOCKS5 proxying. Reconnaissance uses SharpShares, nltest, Nmap, NetExec and BloodHound. Privilege escalation and lateral movement include NTLM coercion and relay (PetitPotam, Coerce Plus, PrinterBug, Impacket ntlmrelayx), Kerberoasting, and Active Directory Certificate Services abuse with Certipy (ESC1, ESC6 and ESC8 referenced). GodPotato was also observed.

AI use is the distinguishing feature. Gambit Security recovered 28 Cursor chat sessions covering ten target organizations between April 8 and May 21, 2026. CloudSEK analyzed an exposed open directory with shell history covering April to July 2026 and 20+ organizations in nine countries. Operators wrote instructions to the Cursor agent in Russian, excluded CIS ranges and domains, and forbade noisy actions such as DCSync, account lockouts and brute-forcing. Most AI-issued commands failed on the first attempt and needed manual refinement, so the activity was human-supervised rather than autonomous. Per the GBHackers summary of Sophos CTU research, operators first relied almost entirely on Anthropic models, then added xAI and Moonshot models. Humans supplied VPN credentials, SOCKS access, targets and objectives, and the agents ran AD discovery, analyzed credential attack paths and moved laterally, prioritizing backup servers, NAS and virtualization hosts.

Data is staged with PowerShell-driven 7-Zip archiving (reported in 50 GB chunks) and exfiltrated to S3-compatible storage with s5cmd (a VeeamTransport-named binary was also used for S3 copying). SQL Server xp_cmdshell abuse was reported. The Windows locker (sap.exe in CloudSEK reporting) deletes shadow copies, disables System Restore and encrypts files in place without changing extensions, dropping !!!README!!!DO_NOT_DELETE.txt. The Linux/ESXi variant (encrypt.out) force-kills VMs with esxcli and encrypts VM disk and state files. Reporting on the cryptography differs between sources: CloudSEK-based reporting cites ChaCha20 with RSA-4096 key wrapping and a Zig codebase, while Cohesity cites the Windows CryptoAPI. Treat the algorithm details as unreconciled.

No CVEs are associated with this threat. Victim counts differ by source and date (3 in the GBHackers article, 4 leak-site victims in THN/CloudSEK, 28 per Ransomware.live via Black Hills, about 40 per Sophos). Severity HIGH is an analyst assignment. BeaconBeagle lookups for the three article IPs returned HTTP 404 (no C2 record).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1566.004 Phishing: Spearphishing Voice
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1685.005 Clear Windows Event Logs
- T1070.006 Indicator Removal: Timestomp
- T1685 Disable or Modify Tools
- T1055.012 Process Injection: Process Hollowing
- T1110.003 Brute Force: Password Spraying
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1649 Steal or Forge Authentication Certificates
- T1087.002 Account Discovery: Domain Account
- T1069.002 Permission Groups Discovery: Domain Groups
- T1135 Network Share Discovery
- T1018 Remote System Discovery
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.006 Remote Services: Windows Remote Management
- T1560.001 Archive Collected Data: Archive via Utility
- T1090 Proxy
- T1572 Protocol Tunneling

## Sources

- [Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations](https://gbhackers.com/aur0ra-ransomware-ai-attacks/)
- [Sophos Threat Profile: GOLD OGRE](https://www.sophos.com/en-us/threat-profiles/gold-ogre)
- [Aurora Ransomware Operators Use Cursor (The Hacker News)](https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html)
- [CSA Research Note: Aurora Ransomware's Abuse of Cursor AI](https://labs.cloudsecurityalliance.org/research/csa-research-note-aurora-ransomware-cursor-ai-abuse-20260901/)
- [Cohesity Red Lab: Aur0ra Ransomware Silent Encryption](https://www.cohesity.com/platform/redlab/advisories/aur0ra-ransomware-silent-encryption/)
- [Black Hills InfoSec: Introducing the Aur0ra Ransomware Group](https://activesoc.blackhillsinfosec.com/blog/introducing-the-aur0ra-ransomware-group/)
- [UVCyber Threat Advisory: Aurora Ransomware](https://www.uvcyber.com/hubfs/ThreatAdvisory-Aurora-Ransomware-2sep26.pdf)
- [WatchGuard Ransomware Tracker: Aur0ra](https://www.watchguard.com/es/wgrd-security-hub/ransomware-tracker/aur0ra)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4921