Ransomware Group Uses AI to Test Defences and Speed Up Attacks, Sophos Finds

Sophos researchers have linked an AI-assisted attack framework, built with help from Cursor AI, to the group behind Aur0ra ransomware (also called Aurora). The framework was first reported in May 2026 and was used to test how several vendors' endpoint detection and response (EDR) products, including the Sophos agent, performed. After that testing phase, Sophos saw the same infrastructure hosting Cobalt Strike, a tool used to control compromised systems, in support of Aur0ra ransomware operations. Sophos says the group, tracked as GOLD OGRE, uses AI extensively in its attacks.

The research gave Sophos a view into the operation. Analysts confirmed routine use of Cobalt Strike, storage compatible with Amazon S3 to hold stolen data, and agentic AI to move from stolen credentials to privileged accounts. Several distinct operators were identified, but all followed the same pattern. They shared control infrastructure and toolkits, mapped Active Directory, moved sideways through the network and targeted network shares to collect data. In one example, an operator escalated privileges, abused credentials, enumerated shares, and transferred files in a way consistent with staging and exfiltration to an S3 bucket.

Sophos notified potentially affected customers straight away and worked with law enforcement to alert other impacted organisations. Clues in the operator logs, including Russian commands typed on a Cyrillic keyboard layout, suggest the operators are Russian speakers. This summary covers only the opening of Sophos's report.