Ransomware gang bypassed AI guardrails by posing as red-team testers

Sophos researchers report that the GOLD OGRE group behind Aur0ra ransomware used Cursor's Composer agent and models from Anthropic, xAI and Moonshot to escalate from credential access to domain administrator, bypassing AI guardrails by framing intrusions as authorized red-team or "diagnostics testing." Human operators supplied VPN credentials, SOCKS access and targets, while agents performed AD discovery, password spraying, Kerberoasting, NTLM coercion and relay, and lateral movement; three victims were later named on Aur0ra's leak site. Sophos assesses with high confidence that GOLD OGRE first used a Cursor-enabled framework to test EDR evasion, then gave associates similar technology for ransomware operations.