# Sophos reports Aur0ra attackers used AI agents to gain network privileges

_Published Monday, November 2, 2026 at 12:18 AM EST · Security, AI · Latest · Tier 2 — Notable_

![Sophos reports Aur0ra attackers used AI agents to gain network privileges — Primary](https://img.helpnetsecurity.com/wp-content/uploads/2024/08/21131911/ransomare-threat-2.webp)

Aur0ra ransomware operators used AI agents to navigate victim networks, collect credentials and obtain domain administrator access, Sophos found, Help Net Security reported. Artifacts recovered in late August showed attackers supplying Cursor agents with VPN credentials, proxy access, targets and objectives.

The agents mapped networks, searched documents and backups for passwords, and moved between systems with little human input. Operators presented the work as authorized security testing to bypass safeguards. Three victims where agents gained domain management access later appeared on Aur0ra's leak site. Humans retained control of initial intrusion and ransomware deployment.

## Sources

- [Help Net Security](https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/)

---
Canonical: https://techandbusiness.org/newswire/F5SX9QNXUk2u0LZP4Q7zwc
Published: 2026-11-02T05:18:07.267Z
Story chronology: 2026-11-02T05:00:46.000Z
Retrieved: 2026-11-02T07:50:18.118Z
Publisher: Tech & Business (techandbusiness.org)