Ransomware gangs are now handing over the most advanced aspects of a network intrusion to AI coding tools. A group affiliated with Aurora ransomware utilized Cursor AI agents to progress from stolen passwords to domain admin access, achieving the highest level of control in a Windows network. The group behind Aurora, also known as GOLD OGRE, relies on human operators for providing VPN access, targets, and goals, while the AI agents handle most of the work with minimal assistance.

Sophos analysts identified the activity while examining an AI-assisted testing framework developed with Cursor. They circumvented AI safety protocols by describing the work as an authorized red team job or "diagnostics testing." The Cursor Composer model executed many of the intrusions, alongside models from Anthropic, xAI, and Moonshot.

Indicators of compromise (IoCs): - IP address: 152.236.4.14 (Data exfiltration server used in Aur0ra ransomware operations) - IP address: 152.236.3.8 (Cobalt Strike C2 server used in Aur0ra ransomware operations) - IP address: 172.86.89.124 (Cobalt Strike C2 server used in Aur0ra ransomware operations) - IP address: 144.172.101.72 (Cobalt Strike C2 server used in Aur0ra ransomware operations) - IP address: 206.223.230.107 (Cobalt Strike C2 server used in Aur0ra ransomware operations) - IP address: 45.59.113.63 (SOCKS proxy node used in Aur0ra ransomware operations)

  • IP address: 172.86.113.245 (Open directory server used in Aur0ra ransomware operations)