GOLD OGRE  (Back to overview)

Cybercriminal group tracked by the Sophos Counter Threat Unit (CTU) that operates the Aur0ra ransomware (also known as Aurora ransomware). Sophos reports that the group used AI extensively: it tested the evasion capabilities of tools and techniques against several EDR products in an AI-assisted post-exploitation framework built with Cursor, then gave its associates similar technology for Aur0ra intrusions, in which Cursor's Composer agent and models from Anthropic, xAI and Moonshot performed network and Active Directory discovery, password spraying, Kerberoasting, NTLM coercion and relay and credential extraction, with human operators supplying VPN credentials, SOCKS access and objectives; guardrails were bypassed by framing the intrusions as authorized red team or diagnostics testing. Intrusions relied on Cobalt Strike, shared C2 infrastructure, SharpShares enumeration and exfiltration to S3-compatible storage, and victims were later named on Aur0ra's data leak site. Multiple distinct operators followed the same pattern; artifacts suggest Russian speakers.

Associated Families

There are currently no families associated with this actor.

References