GOLD OGRE

GOLD OGRE is a financially motivated cybercriminal group operating Aur0ra ransomware, also spelled Aurora. Its operations combine enterprise network compromise, data theft, ransomware deployment, and publication of victims on a data-leak site. Its ransomware tooling includes Windows and Linux variants, including support for VMware ESXi environments. Russian-language prompts and Cyrillic keyboard artifacts indicate Russian-speaking operators but do not establish their nationality or operating location. The group extensively uses agentic AI for tool development, endpoint detection and response evasion testing, and post-exploitation. Operators provide compromised credentials, VPN and proxy access, targets, and objectives to agents orchestrated through Cursor's Composer functionality, using models from Anthropic, xAI, and Moonshot. Agents perform network and Active Directory discovery, identify privileged access paths, search files and backups for credentials, execute commands, and move laterally with limited human intervention. Human operators retain control over initial compromise and ransomware deployment. The operators seek to circumvent AI safeguards by framing malicious tasks as authorized security testing or diagnostics. GOLD OGRE's techniques include password spraying, Kerberoasting, NTLM coercion and relay, authentication-certificate abuse, process injection, and privilege escalation to domain administrator access. Associated tooling includes Cobalt Strike, BloodHound, Nmap, NetExec, SharpShares, Impacket, PetitPotam, and Certipy. Operators collect information from network shares, documents, backup repositories, and cloud-connected storage, staging and exfiltrating stolen data to S3-compatible storage. Multiple operators share command-and-control infrastructure and attack toolkits. The group has also supplied associates conducting Aur0ra attacks with AI-assisted technology developed through its evasion-testing activities.