The Ransomware Gang Using Your Developer's Favorite AI Tool

A ransomware group called Aur0ra has been handing stolen VPN credentials to an AI coding assistant, pointing it at a target network, and letting it find its own way to domain administrator access. The AI tool doing the work is Cursor, the same coding assistant that tens of thousands of software developers use every day.

Sophos published the findings through its Counter Threat Unit, based on artifacts recovered in late August 2026. The group, which Sophos tracks as GOLD OGRE, gave AI agents network access, proxy connections, and a set of objectives. The agents then mapped Active Directory, hunted for passwords in file shares, documents, and backups, and moved laterally across networks with minimal human direction. In some environments, the agents reached domain administrator access. Three of those victims were later named on the group's data leak site.

The initial break-in and the final ransomware deployment stayed under human control. Everything in between was delegated to the machine.

Why This Should Change Your Threat Model

Most boardroom conversations about AI and cybersecurity still focus on deepfakes, phishing emails written by chatbots, or the distant possibility of autonomous attacks. This incident is none of those things. It is a working example of a criminal operation using commercially available AI tools to compress the most time-consuming phase of a network intrusion: the slow, methodical work of mapping a network, finding credentials, and escalating access.

The AI agents ran through Cursor's Composer model, using language models from Anthropic, xAI, and Moonshot. To get past the safety guardrails built into those models, the operators told the AI they were conducting authorized red team testing. One operator described the Windows Active Directory environment as something that "needed testing" and offered to set up proxy access and user accounts for the agent. Another told the agent to stop brute-forcing domain admin accounts and switch to quieter methods. A third asked it to locate backup servers, NAS devices, and virtualization systems.

This is not science fiction. It is a ransomware crew running a penetration test with an AI assistant, exactly the way a legitimate security consultant might, except without authorization, and with extortion as the goal.

The Speed Problem

When I talk to boards about cyber risk, the concept of attacker dwell time comes up often. The industry measures how long an intruder sits inside a network before being detected. The current median across the industry is measured in days. Defenders build their response plans around that window.

AI agents compress that window. A human attacker who gains network access might spend hours or days probing Active Directory, testing credentials, and looking for paths to higher-privilege accounts. An AI agent working through the same steps can try dozens of approaches in minutes. It refines failed commands, modifies scripts, and attempts alternative methods automatically. Sophos found exactly this behavior in the recovered artifacts.

The implication for your organization is direct: if your detection and response capabilities are sized for human-speed attackers, they may not be fast enough for AI-assisted ones.

What Boards Should Ask This Week

In Cyber Risk Is Business Risk, I outline the Three Questions framework that every board should be able to answer about any significant threat. Here is how it applies to AI-assisted intrusions.

Can it happen to us? If your organization has remote access infrastructure (VPN, remote desktop, or cloud identity), the answer is almost certainly yes. The Aur0ra operators did not exploit exotic zero-day vulnerabilities. They used stolen credentials and then handed the rest to an AI. Sophos recommends patching internet-facing devices and deploying phishing-resistant multi-factor authentication as baseline defenses.

Have we done enough? Ask your CISO whether your endpoint detection and response (EDR) tools can distinguish between a legitimate AI coding assistant and one being directed by an attacker. The answer, for most organizations, is that they cannot. Sophos assessed with high confidence that GOLD OGRE used AI to test whether its tools could evade EDR products before deploying them against real targets. Your security team should be running the same tests in reverse: can our defenses detect an AI agent doing reconnaissance on our network?

How would we know? The behavioral signatures of AI-assisted lateral movement look different from human-driven attacks. Automated agents tend to generate bursts of rapid, systematic queries against Active Directory, try multiple credential-based attacks in quick succession, and adapt their approach faster than a human operator would. If your security operations center is tuned to flag patterns of human behavior, it may miss the machine.

The Bigger Governance Question

Sophos concluded its report with a prediction: it is "highly likely" that other ransomware groups will build AI agents into their operations. Gambit Security and CloudSEK independently documented similar Aur0ra activity from the same period, and Gambit specifically identified a Claude model being used in semi-automated attacks.

This raises a governance question that goes beyond any single incident. Most organizations have policies governing how their own employees use AI tools. Very few have updated their threat models to account for adversaries using the same tools. The gap between those two conversations is where risk accumulates.

The board does not need to understand the technical details of Kerberoasting or NTLM relay attacks. But it does need to know that the same category of AI tool it approved for its development team is now being used by criminal groups to break into networks faster than human defenders can respond.

That is a risk conversation worth having before the next board meeting, not after.