kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

GOLD OGRE

1 story · 1 in the wild · November 2, 2026 – November 2, 2026

evidence: 1 observed

geography

  • russia 1 · Nov 2

malware and tools

  • aur0ra 1 · Nov 2
  • cobalt strike 1 · Nov 2

techniques

  • credential access 1 · Nov 2
  • lateral movement 1 · Nov 2
  • privilege escalation 1 · Nov 2
  • process injection 1 · Nov 2

attack phases seen

  • Collection 1 · Nov 2
  • Credential access 1 · Nov 2
  • Lateral movement 1 · Nov 2
  • Privilege escalation 1 · Nov 2

what we reported, newest first, grouped by story

November 2, 2026

  • Sophos CTU links the GOLD OGRE crew behind Aur0ra ransomware to heavy AI use, after infrastructure hosting a Cursor-built AI-assisted post-exploitation framework — one that tested several vendors' EDR agents, including Sophos' — later turned up hosting Cobalt Strike for Aur0ra operations. Multiple distinct operators followed one pattern: AD and share enumeration with SharpShares, privilege escalation, process injection, credential/token abuse, and staging to S3-compatible storage via a VeeamTransport binary. Operator logs contain зы and ды — ps and ls typed on a Cyrillic layout (Sophos). · Nov 2 · observed · AI Inside the Intrusion