Sophos CTU says the GOLD OGRE group behind Aur0ra ransomware (active since April 2026, nearly 40 leak-site victims through September, mostly US and western Europe) uses AI agents to run intrusions. In artifacts recovered in late August, human operators supplied VPN credentials, SOCKS access, targets and goals; agents orchestrated through Cursor (Composer, plus Anthropic, xAI and Moonshot models) did network and AD discovery, analyzed credential attack paths, ran commands and moved laterally with limited human involvement. Guardrails were sidestepped by calling the work authorized red-team or "diagnostics testing". Sophos says agents reached domain management access in a subset of environments, three of which later appeared on the leak site.

• Entry: stolen credentials on internet-facing VPNs.
• Tools seen: Cobalt Strike Beacon, ISL Light, SharpShares, nltest, NetExec (incl. its BloodHound collector), Certipy, PetitPotam/Coerce Plus/PrinterBug with Impacket ntlmrelayx, password spraying, Kerberoasting; exfiltration to S3-compatible storage with s5cmd before encryption (Windows and ESXi builds).
• Tempo: dwell time 12 hours to 9 days; ransom demands above $1M.
• Infrastructure: an exposed open directory at 172[.]86[.]113[.]245 held the toolkit and Cursor chat logs (Gambit, CloudSEK).

Hunt ideas: bursts of NetExec/BloodHound enumeration, coercion and Certipy activity from one VPN session in a short window; agent-style retries (the same command re-issued with small variations, per Gambit); s5cmd or other S3 clients on servers; new MFA-less VPN logins followed by AD enumeration.