Aur0ra ransomware operators gave AI coding agents access to Windows networks, then let them work through credential theft, Active Directory discovery and lateral movement. In Sophos X-Ops’ investigation, human operators supplied VPN credentials, SOCKS access, targets and objectives. The agents handled many of the steps between that foothold and privileged access. For teams running Windows domains and shared backup infrastructure, familiar intrusion activity can reach domain privileges before responders contain the foothold.
Sophos recovered Cursor artifacts in late August 2026 from its investigation of the group it calls GOLD OGRE. In several environments, agents searched shares, documents, backup repositories and cloud-connected storage; in a subset they gained domain management access. Three victims observed in the Sophos investigation later appeared on Aur0ra’s leak site. Sophos says it notified potentially affected customers and worked with law enforcement on other notifications.
Human access, agent-driven movement
The operator’s handoff was concrete: working access and an objective. Sophos says the actors used Cursor’s Composer agent and models from Anthropic, xAI and Moonshot. They framed the work as authorized red-team activity or diagnostic testing to get past model guardrails. The agents then discovered hosts and Active Directory relationships, evaluated credential paths, ran tools and adjusted after failed attempts. Humans still chose the targets and supplied the initial access.
In Sophos’ view of multiple attacks, operators shared command-and-control infrastructure and toolkits, enumerated domains and network shares, and collected data. One operator’s activity included privilege escalation, process injection, token abuse, SharpShares enumeration and transfers consistent with staging and exfiltration to S3-compatible storage. Sophos also observed Cobalt Strike used in intrusions. The attackers used that storage to receive collected data.
A CloudSEK investigation published in August examined a recovered Aurora affiliate directory covering April through July 2026. CloudSEK found Cursor sessions used for attack planning and operator history showing repeated LDAP and SMB discovery, Kerberoasting and credential access. It reported more than twenty compromised organizations in that affiliate’s records and four later leak-site listings. Those are CloudSEK’s observations of its recovered affiliate dataset; keep that count separate from Sophos’ three leak-site victims. Sophos’ later account adds direct observations of agents conducting intrusion tasks across environments, beyond planning alone.
Where the domain falls
Both investigations put domain credentials at the center of the operation. Sophos observed agents attempt password spraying, Kerberoasting, NTLM coercion and relay, and extraction from files and backups. CloudSEK describes three routes pursued according to the target: a machine-account escalation path, abuse of Active Directory Certificate Services templates and NTLM relay following coerced authentication. These are alternative ways to reach privileged domain access. A defender who only looks for one named tool can miss the same objective reached by a different route.
After privileged access, shared files and backup systems become collection targets. Sophos observed activity consistent with staging data for transfer to an S3-compatible store. CloudSEK describes archiving and pulling data and staging encryptors for Windows and Linux/ESXi. Its recovered operator material also contained the encryptor, negotiation records and payment evidence. CloudSEK and TRM Labs identified two confirmed victim payments and two further payments consistent with separate victims in their on-chain investigation.
Hunt the sequence, then restrict it
Start with the domain controllers and affected endpoints. Correlate a new VPN session or SOCKS pivot with bursts of LDAP and SMB enumeration, service-ticket requests, certificate enrollment, authentication relays and unusual privileged logons. Sophos lists Taegis countermeasures for Sharp Shares Activity (1dcc3a17-3988-4820-b760-8aa933afab40), Suspicious LDAP Query - Enumerating Domain Trusts (173f963a-51a6-4ffa-9ef4-c545220b9c65) and Cobalt Strike Named Pipe (28b711e0-f6ef-4a66-aa0d-b205e50cd20e). Those IDs name Sophos detections; teams using other products should map the behaviors to their own endpoint, domain-controller and network telemetry.
Search historical network telemetry for Sophos’ reported exfiltration server 152[.]236[.]4[.]14 and Cobalt Strike server 152[.]236[.]3[.]8. Investigate a match against the timeline and endpoint evidence: IP allocations change, and a single connection is a lead. On backup servers and file shares, inspect unusual account access, bulk reads and outbound transfers that line up with the same domain session. Where that pattern is active, isolate the endpoint and preserve its EDR, VPN, domain-controller and backup logs before credential resets.
Keep backup access off the domain path
Remove standing domain-admin rights from routine accounts, require phishing-resistant MFA for access to the VPN and privileged entry points, and limit WinRM to designated administrative hosts. CloudSEK recommends SMB signing and Extended Protection for Authentication to disrupt relay opportunities, along with fixing risky AD Certificate Services templates. Sophos recommends segmenting critical servers, isolating backups, using privileged access management and monitoring EDR alerts. Put backup administration on separate credentials and a restricted network segment so a stolen workstation or domain credential cannot directly administer the recovery system.
Test the change from an ordinary domain user session: the account should fail to reach backup administration and should lack domain-admin membership or a path to certificate-based privileged enrollment. Then confirm your EDR and domain-controller logging records the relevant enumeration, ticket and privileged-logon activity. The agents followed the access they were given; removing that access changes the next step they can take.