GOLD OGRE uses Cursor and Claude AI agents to automate Aur0ra ransomware attacks
AI SECURITYAnthropicredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Sophos Counter Threat Unit reported in May 2026 that GOLD OGRE is using AI coding agents, including Cursor and Anthropic's Claude, to automate post-exploitation activity leading to Aur0ra ransomware deployments. The agents reportedly moved from credential access to domain administrator with little human involvement. The article gives no CVE IDs, affected versions or indicators, so defenders should focus on detecting unusual automated post-exploitation and privilege escalation activity in their environments.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Threat actors
Malware