AI Used in Aur0ra Ransomware Testing and Execution
Sophos, Thursday, October 29th, 2026
Sophos CTU finds the GOLD OGRE group behind Aur0ra ransomware uses AI extensively, including for escalation and EDR testing.
In May 2026 Sophos CTU reported an AI-assisted post-exploitation framework that tested several vendors' EDR products, and later saw the same infrastructure hosting Cobalt Strike for Aur0ra ransomware operations.
Analysis shows GOLD OGRE uses AI heavily; the framework was built with Cursor AI assistance, and the group routinely uses Cobalt Strike, S3-compatible storage for stolen data and agentic AI to escalate from credential access to privileged accounts.
Multiple operators followed the same attack pattern.
Sophos notified potentially impacted customers and worked with law enforcement on other notifications.