Cybersecurity company Sophos published an analysis of GOLD OGRE, the group behind Aur0ra ransomware, finding that it relies heavily on AI both for tool development and for running operations. According to Sophos, it is a financially motivated group whose victims are mostly in the US and Western Europe, and whose ransom demands have exceeded $1 million.
An AI attack lab
According to Sophos, researchers found a testing environment built with the Cursor coding tool, containing Windows and Linux versions of the ransomware and chat logs with the AI. The company assesses "with high confidence" that the group used AI to test techniques for evading endpoint detection and response (EDR) systems, and passed similar technology to its affiliates.
What the AI didn't do
To be precise: according to Sophos, there is no sign that AI was built into the malware itself or ran autonomously on victims' machines. AI was used to speed up research, development and testing. Secondary reports claimed the Claude Opus 4.5 model was used, but that was not confirmed in Sophos's original publication.
The trend
The report joins Microsoft's findings on North Korean hacker groups that integrated AI into attacks. The conclusion is similar: AI doesn't create a new kind of attacker, but lets small groups work faster and at larger scale. Defenders need to adopt AI to keep up.
