Sophos Details AI-Assisted Aur0ra Ransomware Operations

Oct 29, 2026 · Original article ↗

Summary

Sophos researchers describe GOLD OGRE’s use of Cursor and other AI agents in Aur0ra ransomware operations, including Active Directory discovery, credential abuse and lateral movement. Three victims were later named on Aur0ra’s leak site.

Key points

Sophos analysts linked infrastructure used in EDR evasion testing to Aur0ra ransomware operations, where the same infrastructure also hosted Cobalt Strike.
Sophos says operators used Cursor’s Composer agent and models from Anthropic, xAI and Moonshot to perform tasks with limited human involvement.
Observed activity included Active Directory and network-share discovery, password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups.
Sophos reported routine Cobalt Strike use and S3-compatible storage for stolen data; one observed file transfer was consistent with staging and exfiltration.
Agents achieved domain-management access in some environments. Three victims were later named on Aur0ra’s leak site; that listing alone does not confirm the claims.
Sophos notified potentially impacted customers and worked with law enforcement on notifications for other affected organizations.
Recommended defenses include patching internet-facing devices, phishing-resistant MFA, monitoring EDR alerts, segmenting critical servers, isolating backups and reviewing privileged access.

Article Details

Attack Vectors: Operators supplied AI agents with previously obtained credentials, VPN credentials, SOCKS access, targets, and objectives; agents performed network and Active Directory discovery, executed commands, and moved laterally with limited human involvement.
Observed techniques included password spraying, Kerberoasting, NTLM coercion and relay, and extracting credentials from files and backups.
Operators enumerated network shares and collected data, with one operation transferring data to an S3-compatible bucket.
Sophos reported privilege escalation, process injection, and credential/token abuse during intrusions.
Defensive Notes: Patch internet-facing devices, deploy phishing-resistant MFA, and monitor EDR alerts; respond quickly to detected activity.
Reduce attacker movement by segmenting critical servers, isolating backups, reviewing domain administrator privileges, using privileged access management, and implementing application controls.
Sophos notified potentially impacted customers and worked with law enforcement to notify other affected organizations.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]172[.]101[.]72`	Cobalt Strike C2 server used in Aur0ra ransomware operations.
IPV4	`152[.]236[.]3[.]8`	Cobalt Strike C2 server used in Aur0ra ransomware operations.
IPV4	`152[.]236[.]4[.]14`	Data exfiltration server used in Aur0ra ransomware operations.
IPV4	`172[.]86[.]113[.]245`	Open directory server associated with Aur0ra ransomware operations; third-party reports described it as containing an attacker toolkit and related artifacts.
IPV4	`172[.]86[.]89[.]124`	Cobalt Strike C2 server used in Aur0ra ransomware operations.
IPV4	`206[.]223[.]230[.]107`	Cobalt Strike C2 server used in Aur0ra ransomware operations.
IPV4	`45[.]59[.]113[.]63`	SOCKS proxy node used in Aur0ra ransomware operations and also observed in the AI-assisted testing framework.
URL	`hxxp[:]//152[.]236[.]4[.]14:54410`	Data-transfer endpoint shown in a command associated with Aur0ra ransomware operations.