Sophos Counter Threat Unit says the group behind Aur0ra ransomware used Cursor agents to escalate from stolen credentials to domain administrator inside victim networks. The group is tracked as GOLD OGRE. Human operators supplied access and objectives, and the agents did most of the discovery, credential attack and lateral-movement work. Three victims where agents reached domain management access later appeared on the Aur0ra leak site, per Sophos.
If you defend Windows networks, the practical message is that the attack techniques are old and your controls still apply, but each stage now moves faster. If you run coding agents yourself, it is a reminder of how much an agent with a shell can do once it holds a credential.
TL;DR
| Question | Answer |
|---|---|
| Who did it? | GOLD OGRE, the cybercriminal group operating Aur0ra (also spelled Aurora) ransomware; Sophos says artifacts suggest Russian speakers |
| What tools? | Cursor agents using Cursor's Composer model and models from Anthropic, xAI and Moonshot |
| What did the agents do? | Active Directory discovery, Kerberoasting, NTLM coercion and relay, certificate abuse, credential extraction from files and backups, share searching |
| Is there a Cursor or Claude bug? | No flaw is described; this is misuse of legitimate tools |
| Am I affected? | Only if your network was a victim; Sophos notified customers and worked with law enforcement on other notifications |
| What should I do? | Check the indicators below, harden AD, segment, isolate backups, respond to EDR alerts fast |
What Sophos reported
The finding came out of a side investigation. In May 2026, Sophos CTU published research on an AI-assisted post-exploitation framework that tested several vendors' endpoint detection and response products, including Sophos's own. After that testing phase, Sophos analysts saw the same infrastructure hosting Cobalt Strike in support of Aur0ra operations. The framework had been built with Cursor AI assistance.
The research data showed several distinct operators who followed one pattern: shared command-and-control infrastructure and toolkits, Active Directory enumeration, lateral movement, and a focus on network shares to collect data. Sophos confirmed routine use of Cobalt Strike, S3-compatible storage for stolen data, and agentic AI to escalate from credential access to privileged accounts.
In late August, Sophos recovered Cursor artifacts tied to both the ransomware work and the EDR evasion testing. Its assessment, made with high confidence, is that GOLD OGRE used AI to test evasion tools and techniques in a Cursor-enabled endpoint testing framework, then gave associates similar technology to use in Aur0ra operations. It also judges it highly likely that other ransomware groups and affiliates will embed agents like Cursor into their operations.
The attack chain, step by step
Sophos describes a workflow in which people keep control of the start and the end, while the agents handle the middle.
Image: Sophos Counter Threat Unit
- Human operators set up access. They provided VPN credentials, SOCKS access, targets and objectives, and previously obtained credentials. Initial access and the final impact stayed human-controlled.
- Agents map the environment. They ran network and Active Directory discovery. The third-party reports Sophos cites describe Nmap or NetExec subnet scans and the BloodHound collector to enumerate the domain.
- Agents analyze credential paths and attack them. Sophos lists password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups. The related reports name PetitPotam, Coerce Plus and PrinterBug for coercion, an Impacket module for relaying, and Certipy for certificate attacks.
- Domain administrator. In a subset of environments the agents reached domain management access. Three of those victims were later named on the Aur0ra leak site.
- Lateral movement and collection. Agents moved between machines and searched network shares, user documents, backup repositories and cloud-connected storage.
- Staging and exfiltration. One operator used SharpShares for share enumeration and then a
VeeamTransportcommand to copy data to an S3-compatible bucket on an attacker server. - Ransomware deployment preparation. Sophos says escalation was in preparation for data collection and ransomware deployment.
How the guardrails were handled
Sophos says the AI guardrails were bypassed by framing the intrusions as authorized red team activity or "diagnostics testing." Its translated sample prompts show how plain the requests were: one operator says they need to test a Windows AD network and offers a SOCKS5 proxy and user accounts; another tells the agent to stop brute-forcing domain administrator accounts and try "less noisy" methods; a third asks it to enumerate backup servers, NAS servers and virtualization across the infrastructure.
None of that needs an exploit against the tool. It is a cover story given to a system that cannot verify who is asking, which is the same social problem that dual-use security tooling has always had.
Models used
Sophos names Cursor's Composer agentic coding model alongside models provided by Anthropic, xAI and Moonshot. Its analysis indicates the actors used Anthropic almost exclusively at first, then introduced the other models, possibly as they shifted from building tools to conducting intrusions. Because Cursor lets a user choose the underlying model, the choice of model was the operators' own.
What third-party reports add
Sophos says Gambit Security and CloudSEK published reports on Aur0ra operations in late August 2026, both apparently based on access to the same exposed open directory at 172[.]86[.]113[.]245. Per Sophos, the directory held an attacker toolkit: Windows and Linux (ESXi-compatible) builds of the Aur0ra ransomware binary, shell history and Cursor chat logs. Gambit explicitly referenced a Claude 4.5 Sonnet agent in semi-automated attacks.
Infosecurity Magazine's coverage of the Gambit study adds numbers: Cursor Agent activity against 10 victims between April 8 and May 26, 2026, with Aurora ransomware activity seen since April. It also quotes the researchers saying the majority of commands failed to reach the stated objective on the first attempt, though some later succeeded. Reported victim counts differ between outlets, so treat them as approximate.
Sophos notes the overlap between the third-party reports and its own framework is in tools and techniques, not infrastructure: only one SOCKS-related address (45[.]59[.]113[.]63) appears in both. That is why it describes the link between the testing framework and the ransomware operations as an assessment rather than a shared-server certainty.
One more detail from Sophos: commands in the operator logs, such as "зы" and "ды", correspond to ps and ls when typed on a Cyrillic keyboard layout, which is part of why it judges the operators to be Russian speakers. That is an inference from artifacts, not attribution proof.
Indicators of compromise
Sophos lists these. IP addresses can be reallocated, so treat a hit as a lead to investigate, not a verdict.
| Indicator | Role |
|---|---|
152[.]236[.]4[.]14 | Data exfiltration server |
152[.]236[.]3[.]8 | Cobalt Strike C2 |
172[.]86[.]89[.]124 | Cobalt Strike C2 |
144[.]172[.]101[.]72 | Cobalt Strike C2 |
206[.]223[.]230[.]107 | Cobalt Strike C2 |
45[.]59[.]113[.]63 | SOCKS proxy node |
172[.]86[.]113[.]245 | Open directory server |
Sophos also published detections covering Chisel SOCKS tunnels, WMI computer enumeration, LDAP queries enumerating domain trusts, Nmap, BloodHound, SharpShares, NetExec, Certipy output files, PetitPotam, Kerberoasting scripts and Cobalt Strike named pipes. Even without Sophos tooling, that list doubles as a hunting checklist for any EDR.
What this means if you run AI coding agents
The agents here ran on attacker machines with attacker accounts, so nothing on your laptop is directly exposed by this report. There are still three useful takeaways.
1. Treat an agent with a shell as a competent operator. Given credentials and a goal, the agents in this campaign picked tools, retried failed commands and summarized results for their operators. Your own coding agent has the same ability to chain ssh, kubectl, cloud CLIs and secret files if you let it. Keep long-lived credentials out of the environment the agent runs in, and prefer short-lived, narrowly scoped ones.
2. Assume cheap, fast reconnaissance after any credential theft. The Claude Code extension backdoor that reached up to 5,000 Cursor users collected only environment variable names, and a patient attacker with an agent can turn that kind of foothold into a map of your estate quickly. The runbook in your first 24 hours after a vendor breach applies: rotate, then watch.
3. Harden the paths the agents used. The techniques are ordinary Active Directory abuse. Sophos recommends patching internet-facing devices, phishing-resistant MFA, segmenting critical servers, isolating backups, reviewing domain administrator privileges, privileged access management and application controls. Its caution is that successful defense relies on a quick response, because AI shortens each stage.
Concretely for admins: review who holds domain admin, check for service accounts with weak passwords that Kerberoasting would reach, disable or restrict NTLM where you can, review certificate template permissions that Certipy-style attacks use, and keep backup credentials outside the domain they protect. Then search logs for the indicators above.
Why this is part of a pattern
Several recent Beam posts show the same shift from different angles: attackers running agents against exposed systems, an open-directory leak that revealed agent-driven bank intrusion work, Wiz's seven fingerprints of agentic attacks and Unit 42's report on a cybercrime agent running on DeepSeek and Cursor. The common thread is that attackers use general-purpose agent harnesses, often through ordinary accounts, and leave artifacts (chat logs, shell history, open directories) that defenders can later read.
That last point is useful to know. Agent sessions are verbose by design, so a group that works through an agent writes down what it did. Sophos's whole account rests on recovered Cursor artifacts. The same is true on your side: an agent session log is evidence.
For the month's other incidents, see the October 2026 attacks timeline.
What Beam can and cannot do here
Beam is local security and observability for the coding agents you run. It does not sit in an attacker's Cursor session and cannot stop someone else from using an agent against a network. What it does is relevant on your side: it records what your own Claude Code and Codex sessions propose to run, flags risky actions such as credential exposure and destructive commands, and with an active workspace policy can deny them through PreToolUse hooks. See the agent hooks documentation for exactly what is wired.
Its limits are real: deny is hook-based for Claude Code and Codex rather than a kernel sandbox, other agents get a stderr note, and a missing cached policy fails open. Detection is heuristic. Reviewing what your agents ran, as in the landing page overview of what Beam watches, is a way to notice an agent doing credential-chain work you did not ask for.
Frequently asked questions
What did Sophos find about Aur0ra ransomware and Cursor?
Sophos Counter Threat Unit reports that the GOLD OGRE group, which operates Aur0ra ransomware, used Cursor agents to escalate from credential access to domain administrator in preparation for data collection and ransomware deployment. Human operators supplied VPN or SOCKS access, targets and objectives, and the agents carried out discovery, credential attacks and lateral movement with limited human involvement.
Which AI models were involved?
Sophos says intrusions were orchestrated by Cursor's Composer agentic coding model and by models from Anthropic, xAI and Moonshot. Its analysis indicates the actors used Anthropic almost exclusively at first and added other models as they moved from building tools to running intrusions.
How did the attackers get past the AI guardrails?
According to Sophos, the guardrails were bypassed by framing the intrusions as authorized red team activity or diagnostics testing. The prompts it quotes, translated from Russian, describe testing a Windows Active Directory network and ask the agent to avoid noisy brute-forcing.
Does this mean Cursor or Claude Code has a vulnerability?
No. Nothing in Sophos' report describes a flaw in Cursor or in any model provider. It describes criminals using legitimate agentic coding tools, with their own accounts, as an intrusion workbench. That is a misuse and policy problem, not a software bug to patch.
What should defenders do?
Sophos recommends patching internet-facing devices, phishing-resistant MFA, close EDR monitoring with fast response, segmenting critical servers, isolating backups, reviewing domain administrator privileges, using privileged access management and application controls. Hunt for the published IP indicators and for Kerberoasting, NTLM relay and certificate-abuse activity.
Does this affect people who run coding agents on their own machines?
Not directly, since the agents ran on attacker infrastructure with attacker accounts. It does show how capable an agent with shell access is at credential-chain attacks, which is why developers should limit what their own agents can read and run, and review what they did.
Related reading
- Claude Code VS Code extension 2.1.313 compromised: SSH backdoor
- AI-led attacks in October 2026
- Wiz: seven fingerprints of agentic attacks
- Unit 42: Bugster Hermes agent, DeepSeek and Cursor cybercrime
- October 2026 attacks timeline
Primary source: Sophos CTU, AI used in Aur0ra ransomware testing and execution · Reporting: Infosecurity Magazine on the Gambit Security study
Accurate as of October 30, 2026. Victim counts differ between reports, and Sophos's link between the testing framework and Aur0ra operations is an assessment; check the Sophos post for updates.