70/100
Sophos says the group behind Aur0ra ransomware, tracked as GOLD OGRE, used AI agents to move through victim networks, collect credentials and work toward domain administrator access. Cursor AI coding assistant artifacts recovered in late August show the attackers giving the agents VPN logins, proxy access, targets and objectives. Defenders should review VPN credential exposure and monitor for lateral movement and privilege escalation.