Date: 10/30/2026
Severity: Critical
Summary
Researchers uncovered GOLD OGRE, a cybercriminal group operating Aur0ra ransomware, using agentic AI tools such as Cursor and models from Anthropic, xAI, and Moonshot to automate post-exploitation activities. The attackers leveraged AI agents for Active Directory enumeration, privilege escalation, credential and token theft, lateral movement, and data collection, while bypassing AI safety guardrails by disguising malicious operations as authorized security testing. The intrusions involved Cobalt Strike, Kerberoasting, NTLM relay, BloodHound, and S3-based data exfiltration, followed by ransomware operations. The findings highlight the growing use of AI-assisted cyberattacks and autonomous agents to accelerate enterprise network compromise.
Indicators of Compromise (IOC) List
IP Address | 152.236.4.14 152.236.3.8 172.86.89.124 144.172.101.72 206.223.230.107 45.59.113.63 172.86.113.245 |
Chisel SOCKS Tunnel Usage | 929ae4db-3004-4300-b051-efe18ce43d12 |
Enumerating All Computers via Windows Management Instrumentation | d3f60f86-ae98-48c9-a539-1723f2b9d7b7 |
Suspicious LDAP Query - Enumerating Domain Trusts | 173f963a-51a6-4ffa-9ef4-c545220b9c65 |
Suspected Nmap Usage | baa936d2-4d47-41bb-95b4-f26ce7b84621 |
Discovery - BloodHound | ce7b6cb7-3a70-482e-8e01-f2c4da6bc6ce |
Sharp Shares Activity | 1dcc3a17-3988-4820-b760-8aa933afab40 |
NetExec Activity (process) | 75ebe5c1-5b9f-43d8-9fa9-c914efba8b7b |
Certipy Output File 2 (filemod) | d6363a91-43ea-4670-93fd-054d19ea3eb6 |
PetitPotam Process | 1d4d9d13-5eec-4bfc-b0ad-ccc88a45ee69 |
PowerShell Kerberoast Credential Theft Script | e3dc985c-9235-460d-b876-993c317f8669 |
Kerberoasting - Invoke-Kerberoast | 6b8f7aca-7e1f-429e-9c63-b9804f4441ce |
Cobalt Strike Named Pipe (filemod) | 28b711e0-f6ef-4a66-aa0d-b205e50cd20e |
Cobalt Strike Stager Persistence (process) | 1ac352ca-508c-4390-8d5d-916958379173 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("144.172.101.72","172.86.113.245","206.223.230.107","152.236.4.14","152.236.3.8","45.59.113.63","172.86.89.124") or srcipaddress IN ("144.172.101.72","172.86.113.245","206.223.230.107","152.236.4.14","152.236.3.8","45.59.113.63","172.86.89.124") |
Reference:
AI-Assisted Aur0ra Ransomware Testing and Execution