Sophos finds Aur0ra ransomware gang used AI agents for network access and credential theft

Artifacts recovered from the Cursor AI coding assistant in late August revealed that attackers were tasking AI agents with various operations, including being provided with VPN logins, proxy access, specific targets, and defined objectives. This evidence comes from Sophos, the firm that monitors the ransomware collective known as GOLD OGRE. Sophos reports that the group responsible for the Aur0ra ransomware has been leveraging AI agents to navigate compromised networks, gather user credentials, and ultimately escalate privileges to attain domain administrator access. The process of this AI-assisted intrusion workflow was detailed in a publication that initially appeared on Help Net Security, titled "Ransomware gang talked AI agents into doing much of its dirty work."