[gold-ogre]

November 2, 2026

• Sophos CTU links the GOLD OGRE crew behind Aur0ra ransomware to heavy AI use, after infrastructure hosting a Cursor-built AI-assisted post-exploitation framework — one that tested several vendors' EDR agents, including Sophos' — later turned up hosting Cobalt Strike for Aur0ra operations. Multiple distinct operators followed one pattern: AD and share enumeration with SharpShares, privilege escalation, process injection, credential/token abuse, and staging to S3-compatible storage via a VeeamTransport binary. Operator logs contain зы and ды — ps and ls typed on a Cyrillic layout (Sophos). · AI Inside the Intrusion

in AI Moves Inside the Intrusion Loop