Threat Overview
Sophos Counter Threat Unit documented real GOLD OGRE / Aur0ra ransomware intrusions using Cursor-assisted agents to accelerate Active Directory discovery, Kerberoasting, NTLM relay/coercion, credential extraction, privilege escalation and lateral movement. Operators supplied compromised credentials, VPN or SOCKS access and objectives. Human operators still controlled initial access and ransomware impact. Sophos observed Cobalt Strike, SharpShares and S3-compatible exfiltration. This is not a vulnerability in Cursor.
References
Sophos CTU — AI used in Aur0ra ransomware testing and execution (October 29, 2026)
Impacted Systems
Microsoft Active Directory, Windows endpoints and servers, file shares and backup infrastructure in on-premises or hybrid deployments. Separately reported Aur0ra binaries also target Linux/ESXi. No specific vulnerable software version or CVE: initial access requires valid compromised VPN or equivalent access and reachability to internal assets. No single port is a confirmed prerequisite.
Why this matters
The campaign demonstrates that AI agents can compress the time from credential theft to privileged access. MSSPs should prioritize observed identity, endpoint and data-transfer behaviors rather than assume use of an AI IDE is itself malicious.
Exploitation Status
Sophos confirms real intrusions, Cobalt Strike infrastructure, credential-led lateral movement and data staging. Sophos observed AI-assisted domain-management access in a subset of cases; three victims later appeared on the Aur0ra leak site. Sophos assesses with high confidence that GOLD OGRE used AI-assisted EDR evasion testing and operational tooling. This is confirmed malicious activity, not an unproven vulnerability exploit.
What this hunt looks for
AD discovery utilities, Kerberoasting, privileged remote logons, SOCKS tunnels, suspicious S3-compatible transfers, historical Aur0ra infrastructure and generic ransomware backup-inhibition follow-up.
Required logs
Microsoft Sentinel DeviceProcessEvents, DeviceNetworkEvents, and SecurityEvent (4769, 4624, 4672). Hunts only work where the relevant telemetry is ingested into Sentinel.
01 — Aur0ra-linked AD and credential attack utilities
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| extend Cmd=tolower(strcat(FileName, " ", ProcessCommandLine))
| where Cmd contains "sharpshares" or Cmd contains "bloodhound" or Cmd contains "sharphound" or Cmd contains "certipy" or Cmd contains "getuserspns" or Cmd contains "secretsdump" or Cmd contains "petitpotam" or Cmd contains "coerceplus" or Cmd contains "netexec" or Cmd contains "invoke-kerberoast"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
| order by TimeGenerated desc02 — Kerberoasting commands and ticket harvesting
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| extend Cmd=tolower(ProcessCommandLine)
| where Cmd contains "kerberoast" or Cmd contains "getuserspns" or (Cmd contains "rubeus" and Cmd contains " asktgs") or (Cmd contains "setspn" and Cmd contains " -t ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId
| order by TimeGenerated desc03 — Unusual Windows Kerberos service-ticket volume
SecurityEvent
| where TimeGenerated >= ago(14d) and EventID == 4769
| extend E=tostring(EventData), ClientIP=tostring(column_ifexists("IpAddress", "")), User=tostring(column_ifexists("Account", ""))
| extend ClientIP=iff(isempty(ClientIP),extract(@"IpAddress[^>]*>([^<]+)",1,E),ClientIP)
| summarize TicketRequests=count(), SampleAccounts=make_set(User,10), SampleEvents=make_set(substring(E,0,250),3) by Computer, ClientIP, bin(TimeGenerated,15m)
| where TicketRequests >= 60
| order by TicketRequests desc04 — S3-compatible transfer commands and VeeamTransport abuse
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| extend Cmd=tolower(ProcessCommandLine)
| where (Cmd contains "veeamtransport" and (Cmd contains "--endpoint-url" or Cmd contains "s3://")) or (Cmd contains "--endpoint-url" and Cmd contains " s3://")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId
| order by TimeGenerated desc05 — Published Aur0ra infrastructure connections
let IOCs=dynamic(["152.236.4.14","152.236.3.8","172.86.89.124","144.172.101.72","206.223.230.107","45.59.113.63","172.86.113.245"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP in (IOCs)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, ActionType
| order by TimeGenerated desc06 — SOCKS tunneling and internal discovery tools
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| extend Cmd=tolower(strcat(FileName," ",ProcessCommandLine))
| where (Cmd contains "chisel" and (Cmd contains "socks" or Cmd contains "client")) or (Cmd contains "plink" and Cmd contains " -d ") or Cmd contains "nxc smb" or Cmd contains "netexec smb" or (Cmd contains "nmap" and (Cmd contains " -pn" or Cmd contains " -sn"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId
| order by TimeGenerated desc07 — Windows privileged remote logons after credential access
let Priv=SecurityEvent
| where TimeGenerated >= ago(14d) and EventID == 4672
| project Computer, PrivTime=TimeGenerated, PrivAccount=tostring(column_ifexists("Account", ""));
SecurityEvent
| where TimeGenerated >= ago(14d) and EventID == 4624
| extend LogonTypeValue=tostring(column_ifexists("LogonType", "")), LogonAccount=tostring(column_ifexists("Account", ""))
| where LogonTypeValue in ("3","10")
| join kind=inner Priv on Computer
| where PrivTime between (TimeGenerated .. TimeGenerated+2m)
| project TimeGenerated, Computer, LogonAccount, LogonTypeValue, PrivAccount, PrivTime
| order by TimeGenerated desc08 — Backup destruction or recovery inhibition follow-up
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| extend Cmd=tolower(ProcessCommandLine), Proc=tolower(FileName)
| where (Proc == "vssadmin.exe" and Cmd contains "delete" and Cmd contains "shadows") or (Proc == "wbadmin.exe" and Cmd contains "delete") or (Proc == "bcdedit.exe" and (Cmd contains "recoveryenabled" or Cmd contains "bootstatuspolicy")) or (Proc == "wevtutil.exe" and Cmd contains " cl ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId
| order by TimeGenerated descDetection Notes
Highest signal: reported tool usage, suspicious VeeamTransport –endpoint-url transfers and published C2 addresses. Kerberos counts and administrative tools can be legitimate. The backup-inhibition query is a generic ransomware follow-up, not a behavior confirmed in every Aur0ra intrusion. IP ownership can change. Missing Defender process/network events or Windows security auditing prevents visibility; no customer Sentinel workspace was queried and no customer finding is asserted.
