Loading malware…
Aur0ra, also known as Aurora ransomware, is a ransomware family operated by the financially motivated cybercriminal group GOLD OGRE. Variants target Windows and Linux systems, including VMware ESXi environments. Its operations combine encryption with data theft and publication-based extortion through a dedicated data-leak site.
GOLD OGRE uses Cursor-orchestrated AI agents to assist enterprise intrusions. Human operators supply previously obtained credentials, VPN or proxy access, targets, and objectives; agents then perform network and Active Directory discovery, search documents and backups for credentials, conduct credential attacks, and support privilege escalation and lateral movement. Observed techniques include password spraying, Kerberoasting, NTLM coercion and relay, and certificate abuse. Operators retain control of initial compromise and ransomware deployment. These intrusion activities are performed through supporting tools and AI agents rather than established native capabilities of the ransomware encryptor.
Associated operations use Cobalt Strike and transfer stolen data to S3-compatible storage before ransomware deployment. GOLD OGRE also uses AI-assisted tooling to test endpoint detection evasion and presents malicious tasks as authorized security testing to bypass AI safeguards. Confirmed targeting includes enterprise networks and virtualization infrastructure; a specific industry focus has not been established.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
GOLD OGRE Uses AI Agents and Cobalt Strike in Aur0ra Ransomware Operations
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.