Aur0ra ransomware group uses Cursor AI agents to reach domain admin and steal data
- Severity
- High
- Sources
- 1
What happened
GOLD OGRE (Aur0ra/Aurora) used Cursor-driven AI agents, including Composer and models from Anthropic, xAI and Moonshot, to escalate from credential access to domain admin, using password spraying, Kerberoasting, NTLM coercion and relay, Certipy certificate abuse, BloodHound, NetExec and Cobalt Strike. Gambit Security and CloudSEK reported an exposed open directory holding Windows and ESXi Aur0ra builds, shell history and Cursor chat logs. Defenders should patch internet-facing devices, enforce phishing-resistant MFA, prioritise EDR alerts, segment critical servers, isolate backups, review domain admin rights and deploy PAM. Block the IoCs in the source report, which were defanged and are not reproduced here.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Patch internet-facing devices promptly.
- Enforce phishing-resistant multi-factor authentication for remote and privileged access.
- Review domain administrator rights and use privileged access management to limit them.
- Segment critical servers, isolate backups and block the indicators of compromise listed in the Sophos report.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors