Sophos
CompanyFacts
- Country
- United KingdomSource: Wikidata
- Founded
- 1985Source: Wikidata
- Sector
- Computer security softwareSource: Wikidata
- Official website
- www.sophos.comSource: Wikidata
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Named in ransomware reports by Help Net SecurityRansomware gang reportedly used AI agents to move through victim networks
- Named in ransomware reports by Cyber Security NewsAur0ra ransomware group uses Cursor AI agents to reach domain admin and steal data
Recent news
2026 rankings of MSSP, incident response, managed SIEM and SOCaaS providers
Four Cyber Security News listicles rank providers of managed security services (MSSP), incident response retainers, managed SIEM and SOC-as-a-Service for 2026. Scores are editorial, weighted on detection quality, transparency, SLA strength and commercial flexibility, and are explicitly not lab results. The articles flag acquisition and roadmap uncertainty at Secureworks (Sophos integration), the Cylance and LogRhythm/Exabeam lineages, and advise checking contract terms before buying.
Ransomware gang reportedly used AI agents to move through victim networks
According to Sophos, the group it tracks as GOLD OGRE, behind Aur0ra ransomware, used AI agents to move through victim networks, collect credentials and escalate to domain administrator access. Sophos recovered artefacts from the Cursor AI coding assistant in late August showing attackers supplying the agents with VPN logins, proxy access, targets and objectives.
GOLD OGRE uses Cursor and Claude AI agents to automate Aur0ra ransomware attacks
The GOLD OGRE group is using AI coding agents, including Cursor and Anthropic's Claude, to automate intrusions that lead to Aur0ra ransomware deployment. Sophos Counter Threat Unit researchers, reporting in May 2026, said the agents progressed from credential access to domain administrator with minimal human involvement.
Aur0ra ransomware group uses Cursor AI agents to reach domain admin and steal data
The Aur0ra ransomware group, tracked as GOLD OGRE, used Cursor AI agents, including its Composer model and models from Anthropic, xAI and Moonshot, to move from stolen credentials to domain admin access in Active Directory environments. The agents mapped networks, tried password spraying, Kerberoasting and NTLM relay, and staged data for exfiltration to S3-compatible storage before ransomware deployment. Sophos says the group also used AI to test evasion of EDR products, and it expects other ransomware groups to adopt similar agents.