Evidence · DiggingBeagle record
Sophos: AI used in Aur0ra ransomware testing and execution
Sophos threat intelligence observes malicious Cursor agent workflows alongside ordinary human-supplied intruder access.
- Source role
- primary disclosure
Evidence record
Sophos threat intelligence observes malicious Cursor agent workflows alongside ordinary human-supplied intruder access.
Claim-level citations (1)
- supportsAur0ra ransomware operators used Cursor agents after acquiring network access: Sophos reports that Aur0ra-related operators supplied credentials and targets to Cursor-based agents that undertook Active Directory discovery and lateral movement, with domain-level access achieved in a subset of environments.
Sophos, AI-assisted intrusions, late August artifacts, Figure 1 and observed attacker prompts