Aur0ra

Also known as: Aur0ra

Ransomware operated by the GOLD OGRE cybercriminal group, reported by Sophos, with Windows and Linux (ESXi-compatible) binaries. Gambit Security and CloudSEK described the operation in late August 2026 from an exposed open directory (172.86.113[.]245) holding the toolkit, shell history and Cursor chat logs; Sophos links it to an AI-assisted EDR evasion testing framework and reports AI agents (Cursor Composer, Anthropic, xAI and Moonshot models) driving Active Directory discovery, credential attacks and lateral movement before data theft to S3-compatible storage and ransomware deployment, with Cobalt Strike C2 and victims named on a data leak site. Naming: Sophos notes it is also known as Aurora ransomware. It is unrelated to misp-galaxy:ransomware=”Aurora Ransomware”, the 2018 family appending .aurora or .animus to encrypted files; the leak-site entry misp-galaxy:ransomware=”aurora” (ransomlook) may correspond to this operation, but the sources read do not confirm it.

Introduction

Ransomware operated by the GOLD OGRE cybercriminal group, reported by Sophos, with Windows and Linux (ESXi-compatible) binaries. Gambit Security and CloudSEK described the operation in late August 2026 from an exposed open directory (172.86.113[.]245) holding the toolkit, shell history and Cursor chat logs; Sophos links it to an AI-assisted EDR evasion testing framework and reports AI agents (Cursor Composer, Anthropic, xAI and Moonshot models) driving Active Directory discovery, credential attacks and lateral movement before data theft to S3-compatible storage and ransomware deployment, with Cobalt Strike C2 and victims named on a data leak site. Naming: Sophos notes it is also known as Aurora ransomware. It is unrelated to misp-galaxy:ransomware=”Aurora Ransomware”, the 2018 family appending .aurora or .animus to encrypted files; the leak-site entry misp-galaxy:ransomware=”aurora” (ransomlook) may correspond to this operation, but the sources read do not confirm it.

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • CloudDuke:
  • Agent.btz:
  • CyberGate:
  • Cyber Eye RAT:
  • Windows Remote Desktop:
  • Cobalt Strike:

Attribution and Evidence

Information pending cataloguing.

References

References pending cataloguing.