Sophos reports Aur0ra attackers used AI agents to gain network privileges

Image: Primary

Published Monday, November 2, 2026 · 12:18 AM EST

Aur0ra ransomware operators used AI agents to navigate victim networks, collect credentials and obtain domain administrator access, Sophos found, Help Net Security reported. Artifacts recovered in late August showed attackers supplying Cursor agents with VPN credentials, proxy access, targets and objectives. The agents mapped networks, searched documents and backups for passwords, and moved between systems with little human input. Operators presented the work as authorized security testing to bypass safeguards. Three victims where agents gained domain management access later appeared on Aur0ra's leak site. Humans retained control of initial intrusion and ransomware deployment.

Sources

Help Net Security

Published by Tech & Business, a media brand covering technology and business. This story was sourced from Help Net Security and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

AI Science

MOSAIC preprint reports better task performance with 72% fewer backbone parameters

Researchers report that MOSAIC, an architecture for learning from multiple types of input, improved average macro-F1, a classification performance measure, by 7.4 points across four tasks while using 72% fewer backbone parameters than a fusion-based baseline.

AI Science

TSFLab preprint reports higher agent task completion with fewer tokens

Researchers report that TSFLab, a workbench for coding agents conducting time series forecasting research, improved task completion by 20-163% and reduced fresh tokens per completed task by 11-66% across baselines in reproduction and benchmarking experiments.

Robotics AI

NablaMimic preprint reports faster humanoid motion training on one GPU

Researchers report that NablaMimic trains a humanoid motion-tracking policy to a score of 0.82 in 20 minutes, compared with 1.2 h for a leading world-model method.

Science AI

AMMA preprint reports lower attention latency with memory-centric chip design

Researchers report that AMMA, a proposed chip architecture for serving long-context AI models, achieves 15.5X lower attention latency and 6.9X lower energy consumption than NVIDIA's H100 in their evaluations.

Science AI

CoFiBreak preprint reports more diverse successful attacks on AI models

Researchers report in a preprint that CoFiBreak, a method for training AI models to test other models' safety defenses, discovered 1.6-2.0x as many distinct successful fine-grained attack strategies as the strongest baseline across frontier victims on HarmBench.

Security AI

Windows infostealer uses AI to rank victims' assets for theft

Windows malware called VOLTA-AUTODOXER uses stolen personal data to request AI assessments of victims and rank their assets by cash-out value, Cisco Talos researchers report.