CloudSEK
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Phishing reported by HackReadHackers distribute ScreenConnect remote access tool via fake Adobe Acrobat pages
- Named in ransomware reports by Cyber Security NewsAur0ra ransomware group uses Cursor AI agents to reach domain admin and steal data
Recent news
Hackers distribute ScreenConnect remote access tool via fake Adobe Acrobat pages
Fake Adobe Acrobat pages are distributing legitimately signed ScreenConnect installers configured to give attackers remote access to Windows PCs, according to CloudSEK's researchers. Users who download from these pages could hand control of their machine to an attacker.
Aur0ra ransomware group uses Cursor AI agents to reach domain admin and steal data
The Aur0ra ransomware group, tracked as GOLD OGRE, used Cursor AI agents, including its Composer model and models from Anthropic, xAI and Moonshot, to move from stolen credentials to domain admin access in Active Directory environments. The agents mapped networks, tried password spraying, Kerberoasting and NTLM relay, and staged data for exfiltration to S3-compatible storage before ransomware deployment. Sophos says the group also used AI to test evasion of EDR products, and it expects other ransomware groups to adopt similar agents.