The research describes attackers who relied on shared command-and-control infrastructure and toolkits to map Active Directory, move across networks and collect data from network shares. Stolen data was held in cloud storage, and AI was used to automate activity and gain greater control over compromised systems.
Sophos found evidence that the operators were Russian-speaking. Operator logs showed Russian characters that correspond to the ps (process enumeration) and ls (directory enumeration) commands when transposed from a Cyrillic keyboard layout.
The group Sophos tracks as GOLD OGRE used AI inside a Cursor-enabled endpoint testing framework to assess how well tools and techniques evaded detection, then shared similar technology with associates involved in Aur0ra ransomware operations.
The research shows threat groups increasingly using AI agents to escalate privileges and widen their control once inside a network. Sophos advised organisations to prioritise security controls that limit an attacker's ability to move across the network after the first breach.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
