Aur0ra Ransomware Operators Use Cursor AI Agents to Escalate Privileges and Steal Data

Sophos and Counter Threat Unit (CTU) researchers linked GOLD OGRE, the operator of Aur0ra ransomware, to AI-assisted intrusions and endpoint detection evasion testing. Human operators supplied stolen credentials, VPN access, targets, and objectives to Cursor-orchestrated AI agents, which performed reconnaissance, credential attacks, privilege escalation to domain administrator, lateral movement, and data discovery with limited assistance. The activity included data theft and preparations for ransomware deployment; three organizations investigated during AI-assisted intrusions subsequently appeared on Aur0ra’s data leak site.

Recovered Cursor records and supporting reporting documented multiple AI models, established offensive tools, Cobalt Strike infrastructure, shared attack toolkits, and S3-compatible storage for stolen data. CTU assessed with high confidence that GOLD OGRE developed AI-assisted evasion-testing capabilities and supplied similar technology to associates conducting Aur0ra operations. The findings show attackers using AI to automate substantial portions of an intrusion rather than merely generate code. Recommended defenses include phishing-resistant MFA, rapid investigation of EDR alerts, network segmentation, isolated backups, and tighter privileged-access controls.