Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data

Ransomware crews are now giving the hardest parts of a network break-in to AI coding tools. A group linked to Aur0ra ransomware used Cursor AI agents to go from stolen passwords to domain admin access, the highest level of control in a Windows network. From there, it collected data and prepared to deploy ransomware.

The group behind Aur0ra, also spelled Aurora, is tracked as GOLD OGRE. Human operators supplied VPN access, targets and goals, and the agents handled most of the work with little help. This lowers the skill needed to run a full intrusion.

It also matters for every company that relies on Active Directory, as shown in an earlier report on Aurora that covered the same crew’s use of AI planning.

Analysts at Sophos identified the activity while studying an AI-assisted testing framework built with Cursor. The company’s Counter Threat Unit published research on that framework in May 2026.

Aur0ra Ransomware Hackers Use Cursor AI Agents

The framework had tested several endpoint detection and response (EDR) products, including Sophos’s own agent. Later, according to the full Sophos analysis, the same infrastructure was seen hosting Cobalt Strike for Aur0ra operations. Sophos said it warned affected customers and worked with law enforcement to notify other victims.

In late August, the analysts recovered Cursor files tied to both the ransomware work and the evasion testing. The attackers used Cursor to climb from credential access to domain administrator.

They got past AI safety rules by describing the work as an authorized red team job or “diagnostics testing.” Cursor’s Composer model ran many of the intrusions, along with models from Anthropic, xAI and Moonshot.

The group used Anthropic almost entirely at first, then added the others as it moved from building tools to breaking into networks. Other crews have been caught using Claude AI to plan ransomware work too, so the habit is spreading.

Once given access, the agents mapped the network and checked for weak paths to powerful accounts. They ran commands, moved from machine to machine, and searched file shares, user documents, backup stores and cloud-linked storage.

They tried password spraying, Kerberoasting, NTLM coercion and relay, and pulled credentials from files and backups. Operators also used common tools like SharpShares and NetExec, which appear in Gentlemen ransomware EDR killers reporting as well.

In some victim networks, the agents reached domain management access, and three of those victims later appeared on the Aur0ra leak site.

Stolen files were staged and sent to S3-compatible storage. Sophos saw one operator use a VeeamTransport command to copy data to a bucket on a server at 152[.]236[.]4[.]14. Logs also showed Russian shortcuts typed on a Cyrillic keyboard layout, which suggests the operators speak Russian.

Third-Party Findings, Shared Tools and Defense Steps

In late August 2026, Gambit Security and CloudSEK published reports that appeared to rely on the same exposed open directory at 172[.]86[.]113[.]245.

It held Windows and Linux (ESXi-ready) versions of the Aur0ra ransomware, shell history and Cursor chat logs. Gambit also noted a Claude 4.5-Sonnet agent in semi-automated intrusions.

That fits with a Claude Code ransomware case in which an operator let the model fix its own commands until a task worked.

Gambit described agents installing a VPN client, scanning subnets with Nmap or NetExec, and mapping the domain with BloodHound.

They also tried NTLM relay through PetitPotam, Coerce Plus and PrinterBug, and used Certipy for certificate abuse. Sophos found the same tools in its own testing framework, but only one SOCKS-related IP address overlapped between the two sets of infrastructure.

Sophos researchers say with high confidence that GOLD OGRE used AI to test how well tools evade detection, then gave similar technology to associates running Aur0ra.

They also expect other ransomware groups to build AI agents like Cursor into their work. Basic defenses still help, including patching internet-facing devices, phishing-resistant multi-factor authentication and close watch on EDR alerts.

Since the AI speeds up each stage, a fast response matters more. Sophos also advises limiting how far an intruder can move by segmenting critical servers, isolating backups, reviewing domain administrator rights, using privileged access management and applying application controls.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data appeared first on Cyber Security News.