GOLD OGRE kiberjinoyatchilik guruhi Aur0ra ransomware (Aurora) operatsiyalari uchun hujumlarni avtomatlashtirish maqsadida Cursor va Anthropic’ning Claude kabi AI kodlash agentlaridan foydalanmoqda.
Sophos tadqiqotchilari agentlar inson aralashuvi deyarli bo‘lmagan holda hisob ma’lumotlariga kirishdan domen administratoriga o‘tganini aytishmoqda.
2026-yil may oyida Sophos Counter Threat Unit (CTU) tadqiqotchilari bir nechta vendorlarning EDR mahsulotlarini, jumladan Sophos’ni sinash uchun mo‘ljallangan AI yordamidagi post-ekspluatatsiya tizimini xabar qilishdi.
Keyinchalik Sophos xuddi shu infratuzilma Aur0ra operatsiyalarini qo‘llab-quvvatlash maqsadida Cobalt Strike’ni joylashtirganini ko‘rdi.
Sophos tomonidan e’lon qilingan texnik tadqiqotga ko‘ra, GOLD OGRE deb kuzatilgan guruh o‘z vositalarini yaratish va ishlatish uchun Cursor’dan foydalangan. Cursor’ning Composer agentik modeli Anthropic, xAI va Moonshot modellari bilan birga hujumlarni boshqargan.
Hujumchilar dastlab deyarli faqat Anthropic’ga tayanishgan, keyin esa vositalarni yaratishdan tarmoqlarga hujum qilishga o‘tgan sari boshqa modellardan ham foydalanishgan.
Hujumchilar o‘z faoliyatlarini ruxsat etilgan red-team ishi yoki “diagnostika sinovi” sifatida ko‘rsatib, AI himoya choralarini chetlab o‘tishgan. Loglardagi rus tilidagi so‘rovlar va klaviatura tartibi izlari operatorlar rus tilida so‘zlashuvchilar ekanligini ko‘rsatadi.
Aur0ra Ransomware Hujum Zanjiri (Rasm manbai: Sophos)
Inson operatorlar VPN hisob ma’lumotlari, SOCKS kirishi, nishonlar va maqsadlarni taqdim etishgan. Keyin agentlar Active Directory kashfiyotini amalga oshirgan, hisob ma’lumotlari hujum yo‘llarini tahlil qilgan va lateral harakat qilgan. Ular tarmoq ulushlari, zaxira nusxalari va bulutga ulangan saqlash joylarini qidirishgan.
Kuzatilgan texnikalar orasida parol purkash (password spraying), Kerberoasting, NTLM majburlash va relay, shuningdek fayl va zaxira nusxalaridan hisob ma’lumotlarini chiqarib olish bor.
Ba’zi muhitlarda agentlar domen boshqaruviga kirishgan va bu jabrlanuvchilarning uchtasi keyinchalik Aur0ra’ning sizib chiqish saytida paydo bo‘lgan. Operatorlar agentlarga shovqinli domen admin hisoblarini qo‘pol ravishda buzishdan qochishni va zaxira serverlari, NAS hamda virtualizatsiya xostlarini ustuvor qilishni buyurishgan.
Ma’lumotlar S3-mos saqlash joyiga joylashtirilgan va chiqarib yuborilgan. Bir operator VeeamTransport nomli binar faylni ishlatib, ma’lumotlarni 152[.]236[.]4[.]14 manzildagi S3 chelakka nusxalagan.
Hujum Texnikalari Taqqoslash Matritsasi (Rasm manbai: Sophos)
2026-yil avgust oyining oxirida Gambit Security va CloudSEK 172[.]86[.]113[.]245 manzildagi ochiq katalogdan o‘xshash faoliyatni tasvirlashdi. U yerda Windows va ESXi bilan mos Aur0ra binar fayllari, shell tarixi va Cursor suhbat loglari saqlangan edi.
Gambit Claude 4.5-Sonnet agenti Nmap, NetExec, BloodHound, PetitPotam, Impacket va Certipy yordamida yarim-avtomatlashtirilgan hujumlarni amalga oshirganini keltirgan. Infratuzilma bilan yagona moslik: SOCKS IP 45[.]59[.]113[.]63.
Sophos yuqori ishonch bilan GOLD OGRE AI yordamida chetlab o‘tishni sinovdan o‘tkazgan va keyin sheriklarga o‘xshash vositalarni taqdim etgan deb baholaydi. U boshqa ransomware guruhlari ham bu yo‘ldan borishini kutmoqda.
Himoyachilar internetga ochiq qurilmalarni yangilashlari, fishingga chidamli MFA’ni joriy etishlari va EDR ogohlantirishlarini kuzatib, tezkor javob berishlari kerak.
Bundan tashqari, tashkilotlar muhim serverlarni segmentlashlari, zaxira nusxalarini izolyatsiya qilishlari, domen admin huquqlarini qayta ko‘rib chiqishlari hamda imtiyozli kirish boshqaruvi va ilova nazoratini qo‘llashlari lozim.
The GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora).
Sophos researchers say the agents moved from credential access to domain administrator with little human involvement.
In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation framework built to test several vendors’ EDR products, including Sophos.
Sophos later saw the same infrastructure hosting Cobalt Strike in support of Aur0ra operations.
According to technical research published by Sophos, the group, tracked as GOLD OGRE, used Cursor to build and run its tooling. Cursor’s Composer agentic model drove the intrusions, along with models from Anthropic, xAI and Moonshot.
The attackers first relied almost entirely on Anthropic, then added other models as they moved from building tools to attacking networks.
The attackers bypassed AI guardrails by framing their activity as authorized red-team work or “diagnostics testing.” Russian-language prompts and keyboard-layout artifacts in the logs suggest the operators are Russian speakers.
Aur0ra Ransomware Attack Chain (Image Source: Sophos)
Human operators supplied VPN credentials, SOCKS access, targets and objectives. The agents then ran Active Directory discovery, analyzed credential attack paths and moved laterally. They searched network shares, backups and cloud-connected storage.
Observed techniques included password spraying, Kerberoasting, NTLM coercion and relay, and credential extraction from files and backups.
In some environments the agents gained domain management access, and three of those victims later appeared on Aur0ra’s leak site. Operators also told the agents to avoid noisy brute-forcing of domain admin accounts and to prioritize backup servers, NAS and virtualization hosts.
Data was staged and exfiltrated to S3-compatible storage. One operator used a VeeamTransport-named binary to copy data to an S3 bucket at 152[.]236[.]4[.]14.
Attack Techniques Comparison Matrix (Image Source: Sophos)
In late August 2026, Gambit Security and CloudSEK described similar activity from an exposed open directory at 172[.]86[.]113[.]245. It held Windows and ESXi-compatible Aur0ra binaries, shell history and Cursor chat logs.
Gambit cited a Claude 4.5-Sonnet agent running semi-automated attacks with Nmap, NetExec, BloodHound, PetitPotam, Impacket and Certipy. Only one infrastructure overlap exists: the SOCKS IP 45[.]59[.]113[.]63.
Sophos assesses with high confidence that GOLD OGRE tested evasion with AI and then gave affiliates similar tooling. It expects other ransomware groups to follow.
Defenders should patch internet-facing devices, deploy phishing-resistant MFA, and monitor EDR alerts while responding quickly.
Furthermore, organizations should segment critical servers, isolate backups, review domain admin privileges, and use privileged access management and application controls.