Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations

What happened

Aur0ra ransomware AI attacks In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation framework built to test several vendors’ EDR products, including Sophos. Sophos is a computer security software company based in Abingdon-on-Thames.

The attackers first relied almost entirely on Anthropic, then added other models as they moved from building tools to attacking networks. The GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Anthropic is an artificial intelligence company based in San Francisco, and its products and services include Claude and Claude Code.

Sophos researchers say the agents moved from credential access to domain administrator with little human involvement.

Sophos later saw the same infrastructure hosting Cobalt Strike in support of Aur0ra operations. According to technical research published by Sophos , the group, tracked as GOLD OGRE, used Cursor to build and run its tooling.

Cursor’s Composer agentic (AI that carries out multi-step tasks rather than answering one question) model drove the intrusions, along with models from Anthropic, xAI and Moonshot. The attackers bypassed AI guardrails by framing their activity as authorized red-team work or “diagnostics testing.”

Russian-language prompts and keyboard-layout artifacts in the logs suggest the operators are Russian speakers.