[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTT_9kSLETbn1FEB3oRLQkUtC0TbVQKjZAeVR8tOlPCE":3},{"article":4,"iocs":53,"watch_terms":61,"solutions":62,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"71d37ae0-8088-484a-9e1e-1f68adb62ce6","Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data","aur0ra-ransomware-hackers-use-cursor-ai-agents-to-gain-domain-admin-access-and-s-90376c","Ransomware crews are now giving the hardest parts of a network break-in to AI coding tools. A group linked to Aur0ra ransomware used Cursor AI agents to go from stolen passwords to domain admin access, the highest level of control in a Windows network. From there, it collected data and prepared to deploy ransomware. The […] The post Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data appeared first on Cyber Security News.","A threat group linked to Aur0ra ransomware, identified as GOLD OGRE, has employed AI agents, specifically Cursor's Composer model and others from Anthropic and xAI, to automate significant portions of network intrusions. These AI agents have been used to escalate from stolen credentials to domain administrator privileges, map networks, exfiltrate data, and prepare for ransomware deployment, thereby lowering the skill threshold for complex attacks.","Aur0ra ransomware hackers leverage AI agents for domain admin access and data theft.","https:\u002F\u002Fcybersecuritynews.com\u002Faur0ra-ransomware-hackers\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FAur0ra-Ransomware-Hackers-Use-Cursor-AI-Agents-to-Gain-Domain-Admin-Access-and-Steal-Data.webp","2026-10-30T14:36:33+00:00","2026-10-30T15:00:13.129763+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"GOLD OGRE","threat_actor",{"name":21,"type":22},"Cursor","product",{"name":24,"type":25},"AI agents","technology",{"name":27,"type":25},"Active Directory",{"name":29,"type":22},"Cobalt Strike","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"ip","152.236.4.14","S3-compatible storage server used for staging stolen data.",{"type":55,"value":59,"context":60},"172.86.113.245","Exposed open directory containing ransomware versions and AI chat logs.",[21,29],{"controls":63,"vendors":147},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":94,"name":95,"problem":96,"products":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":45,"name":123,"problem":124,"products":125},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":143,"product_name":144,"url":145,"description":146},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"ai-powered-ransomware-actors-automate-domain-takeover-using-cursor-ai-agents","AI-Powered Ransomware Actors Automate Domain Takeover Using Cursor AI Agents","The GOLD OGRE threat group demonstrated that AI coding and automation tools like Cursor's Composer model can be weaponized to dramatically lower the skill barrier for complex intrusions, enabling attackers to escalate stolen credentials all the way to domain administrator access with minimal manual effort. The root cause lies in inadequate access controls — once initial credentials were compromised, there were insufficient barriers (MFA, privileged access management, least-privilege enforcement) to prevent lateral movement and privilege escalation. This matters because AI-assisted attacks compress the attack timeline significantly, leaving defenders less time to detect and respond before ransomware is deployed. Organizations must assume that commodity credential theft can now rapidly translate into full domain compromise when AI agents are involved.",[159,160,161,162,163,164,165],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":167,"MITRE ATT&CK T1566: Phishing":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"CIS Control 17: Incident Response Management":170,"CIS Control 14: Security Awareness and Skills Training":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires incident handling and access control measures sufficient to limit the impact of compromised credentials, directly addressing the failure to contain GOLD OGRE's lateral movement and data exfiltration activities.","Initial credential theft — the prerequisite for AI-agent-driven escalation — typically begins with phishing, and understanding and defending this initial access vector is critical to preventing the entire attack chain described.","AI-assisted attackers can rapidly identify and exploit misconfigurations and unpatched vulnerabilities during automated network mapping, making timely flaw remediation essential to reducing the attack surface available to automated agents.","AI agents compress attack timelines dramatically, meaning incident response plans must be pre-tested and automated enough to detect and contain domain-level compromise before ransomware deployment is triggered.","Staff and administrators unaware of AI-augmented attack tradecraft are less likely to recognize the speed and behavioral patterns of AI-driven intrusions, making human-layer detection of this novel threat category nearly impossible without targeted training.","Systematic tracking and remediation of technical vulnerabilities across Active Directory and network infrastructure would reduce the exploitable footholds that AI agents leverage to achieve privilege escalation.","GOLD OGRE pivoted from stolen credentials to domain admin without encountering MFA or PAM controls; this framework function directly requires strong authentication and access restrictions that would have broken the escalation chain."]