GOLD OGRE used AI agents to expand ransomware intrusions
Sophos says GOLD OGRE used AI agents to map networks, hunt credentials and move laterally in Aur0ra ransomware intrusions; artifacts recovered in late August show operators supplying stolen virtual private network (VPN) logins, proxy access and objectives. Humans still controlled initial access and ransomware deployment.
The operators framed the work as authorized red-team testing, which helped them get past the tools’ safeguards. Given stolen logins and a goal, the agents mapped Active Directory and searched network shares, documents and backups for passwords, then moved between systems. In some intrusions they reached domain management; three victims later appeared on Aur0ra’s data leak site.
For organizations using coding agents for authorized testing, the red-team pretext shows how those tools can be steered toward real intrusion work. If an intrusion begins with stolen VPN credentials, the exposure may extend beyond that account to domain management, while backup, network-attached storage and virtualization systems may also enter the agents’ search.