GOLD OGRE: AI-Assisted Intrusion and Aur0ra Ransomware Operations

Sophos analysts identified the GOLD OGRE threat group using AI-assisted frameworks to orchestrate ransomware operations. The actors utilize Cursor AI, alongside Anthropic, xAI, and Moonshot models, to bypass security controls and automate post-exploitation activities. By framing malicious tasks as authorized "red team activity" or "diagnostics," actors use agentic AI to escalate privileges, enumerate Active Directory, and perform lateral movement before deploying Aur0ra ransomware.

Attack Chain

1. Initial Access: Operators provide VPN credentials and SOCKS access to AI agents.
2. EDR Evasion Testing: Actors use Cursor AI-assisted frameworks to test detection capabilities against security agents.
3. Internal Discovery: Agents execute Nmap and NetExec to scan subnets and BloodHound to map Active Directory.
4. Privilege Escalation: Agents conduct Kerberoasting, NTLM relay attacks (e.g., PetitPotam, Coerce Plus), and credential extraction.
5. Lateral Movement: Agents enumerate network shares, backup repositories, and virtualization endpoints.
6. Data Collection: Tools like SharpShares are used to stage data from shares and documents.
7. Exfiltration: Staged data is exfiltrated to S3-compatible storage buckets via command-line tools.
8. Impact: Deployment of Aur0ra ransomware and subsequent data leakage on extortion sites.

Recommendation

• Monitor for anomalous use of AI/IDE tools like Cursor in enterprise environments, especially if used to execute network commands or enumeration tools.
• Audit and restrict NTLM authentication pathways and enforce SMB signing to mitigate relay attacks (e.g., PetitPotam).
• Implement stringent egress filtering to prevent unauthorized data exfiltration to non-approved S3-compatible storage endpoints.
• Review and tighten access to backup repositories and virtualized infrastructure to prevent bulk data staging.