AUR0RAAur0ra

Ransomware operated by the GOLD OGRE cybercriminal group, reported by Sophos, with Windows and Linux (ESXi-compatible) binaries. Gambit Security and CloudSEK described the operation in late August 2026 from an exposed open directory (172.86.113[.]245) holding the toolkit, shell history and Cursor chat logs; Sophos links it to an AI-assisted EDR evasion testing framework and reports AI agents (Cursor Composer, Anthropic, xAI and Moonshot models) driving Active Directory discovery, credential attacks and lateral movement before data theft to S3-compatible storage and ransomware deployment, with Cobalt Strike C2 and victims named on a data leak site. Naming: Sophos notes it is also known as Aurora ransomware. It is unrelated to misp-galaxy:ransomware="Aurora Ransomware", the 2018 family appending .aurora or .animus to encrypted files; the leak-site entry misp-galaxy:ransomware="aurora" (ransomlook) may correspond to this operation, but the sources read do not confirm it.