Sophos reports that the group behind the Aur0ra ransomware, which it tracks as GOLD OGRE, gave AI agents VPN logins, proxy access and objectives, and the agents then mapped the network and Active Directory, hunted for passwords in shares and backups and moved laterally, Help Net Security reports. In some networks they reached domain administrator rights. To get around the tools' guardrails, the attackers presented the intrusions as authorised red team exercises. Initial access and deploying the ransomware stayed in human hands.

What it means: The report describes what many experts expected: ransomware groups are using AI agents for the most time-consuming phases of an attack, exploring the network and hunting for passwords. That shortens the time from entry to encryption and lets smaller groups handle more victims at once. The fact that operators told the agent to avoid noisy methods shows they are also adapting to detection. For Greek businesses the basic measures still work, as Sophos itself notes: patched internet-facing devices, phishing-resistant authentication and, above all, fast response to EDR alerts, because the window for intervention is narrowing. It is worth checking whether passwords sit in files on shared folders, since that is the first thing an automated agent finds. Backups need to be isolated from the domain, with offline copies that the agents cannot reach. The report also raises questions for providers of AI coding tools, who need to get better at spotting fake penetration testing stories.

Read the original on Help Net Security

Related service: Custom software

Related stories