Threats · 3h ago
Sophos says GOLD OGRE used AI agents to map networks, hunt credentials and move laterally in Aur0ra ransomware intrusions; artifacts recovered in late August show operators supplying stolen virtual private network (VPN) logins, proxy access and objectives. Humans still controlled initial access and ransomware deployment.
The operators framed the work as authorized red-team testing, which helped them get past the tools’ safeguards. Given stolen logins and a goal, the agents mapped Active Directory and searched network shares, documents and backups for passwords, then moved between systems. In some intrusions they reached domain management; three victims later appeared on Aur0ra’s data leak site.
For organizations using coding agents for authorized testing, the red-team pretext shows how those tools can be steered toward real intrusion work. If an intrusion begins with stolen VPN credentials, the exposure may extend beyond that account to domain management, while backup, network-attached storage and virtualization systems may also enter the agents’ search.
1 source covering this story
Ransomware gang talked AI agents into doing much of its dirty work - Help Net Security
The group behind Aur0ra ransomware gave AI agents stolen credentials and let them move through victim networks toward domain admin access.
Part of the PlainSec briefing for 2026-11-02