Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data

What happened?

Ransomware crews are now giving the hardest parts of a network break-in to AI coding tools. A group linked to Aur0ra ransomware used Cursor AI agents to go from stolen passwords to domain admin access, the highest level of control in a Windows network. From there, it collected data and prepared to deploy ransomware. The group behind Aur0ra, also spelled Aurora, is tracked as GOLD OGRE. Human operators supplied VPN access, targets and goals, and the agents handled most of the work with little help. This lowers the skill needed to run a full intrusion.

Key details

• Aur0ra ransomware group used Cursor AI agents to gain domain admin access from stolen passwords.
• Human operators provided VPN access and targets while AI agents handled most intrusion work.
• Operators used Russian-language shortcuts on Cyrillic keyboards, suggesting Russian-speaking actors.
• Sophos identified the activity while studying an AI-assisted testing framework built with Cursor.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.