What changes when an AI agent runs the ransomware intrusion?
Quick answer, Nov 6, 2026As of 6 November 2026, Sophos has documented a ransomware group using AI agents to run the middle of an intrusion: discovery, credential attacks and lateral movement, with people supplying the access and firing the ransomware. The required controls do not change. The time you have to use them does.
What the research says
Sophos's Counter Threat Unit published AI used in Aur0ra ransomware testing and execution on 29 October 2026. Under "Sophos analysis" it reports that the group behind Aur0ra ransomware used "agentic AI to escalate from credential access to privileged accounts", and that "AI guardrails were bypassed by framing the intrusions as authorized red team activity or 'diagnostics testing'."
The division of labour matters for an underwriting file. People kept initial access and the ransomware, supplying VPN credentials, proxy access, targets and objectives. The AI agents ran network and Active Directory discovery, analysed credential-based attack paths, executed commands and moved laterally "with limited human involvement": password spraying, Kerberoasting, NTLM coercion and relay, credential extraction, and searches of network shares, backup repositories and cloud storage. In a subset of environments they reached domain management access; three of those victims were later named on the group's leak site. The attackers steered for stealth — one recovered prompt, in Sophos's translation (Table 1, "Sample prompts used in AI-orchestrated intrusions"), reads: "Don't try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors."
NIST AI 600-1, section 2.9 "Information Security", named the risk before it was seen in the field: sophisticated threat actors "might further these risks by developing GAI-powered security co-pilots for use in several parts of the attack chain, including informing attackers on how to proactively evade threat detection and escalate privileges after gaining system access."
Five checks to run before an incident
Sophos's "Recommendations" section is blunt: existing controls "are still effective, but successful defense relies on a quick response." Goal numbers below are CISA's Cross-Sector Cybersecurity Performance Goals, version 1.0.1, March 2023 update.
| What the AI agents did | The check | Where it is written |
|---|---|---|
| Password spraying against the domain | Failed logins logged and alerted after a set number in a short period, with a system-enforced lockout | CISA CPG 2.G, "Detection of Unsuccessful (Automated) Login Attempts" |
| Escalated to domain management | "No user accounts always have administrator or super-user privileges", "reevaluated on a recurring basis" | CISA CPG 2.E, "Separating User and Privileged Accounts" |
| NTLM coercion and relay; credentials pulled from files | Phishing-resistant MFA, "the strongest available method for that asset", privileged accounts first | CISA CPG 2.H, "Phishing-Resistant Multifactor Authentication (MFA)" |
| Searched backup repositories and cloud storage | Backups "stored separately from the source systems and tested on a recurring basis" | CISA CPG 2.R, "System Backups" |
| Moved laterally with little human involvement | Segment critical servers, isolate backups, review domain administrator privileges, use privileged access management and application controls | Sophos CTU, "Recommendations" |
None of these are new. The underwriting question is whether they are evidenced rather than asserted, and whether the plan has been drilled: CPG 2.S, "Incident Response (IR) Plans", asks for plans "drilled at least annually".
Three things that change in the first 72 hours
Containment is identity-first. The entry point here is working credentials, not malware. The #StopRansomware Guide (CISA, FBI, NSA and MS-ISAC), Part 2, step 13: "Disable virtual private networks, remote access servers, single sign-on resources, and cloud-based or other public-facing assets."
Isolate quietly. Part 2, step 1 says to isolate systems "in a coordinated manner and use out-of-band communication methods such as phone calls to avoid tipping off actors," because otherwise they may "deploy ransomware widely prior to networks being taken offline."
The sequence is the deliverable, and the evidence is short-lived. NIST SP 800-61r3 (April 2025), Table 3, element RS.AN-03, recommendation R1: "Determine the sequence of events that have occurred during the incident and which assets and resources were involved in each of those events." That reconstruction is only as good as the log retention set under CISA CPG 2.U, "Secure Log Storage". Part 2, step 9 says to preserve evidence "that is highly volatile in nature—or limited in retention", naming system memory, Windows Security logs and firewall log buffers.
Reporting does not change: Part 2, "Reporting and Notification", step 7 says to report to CISA, your local FBI field office, IC3 or the Secret Service. The sanctions analysis before any payment is a separate job, set out in First 72 hours after ransomware; picking the firm that runs the response is in Choosing a crisis response firm for a cyber incident.
Reading the record from an AI assistant
The Distributed Risk MCP server serves this record: list_cyber_advisories with ai_stack set to true for CISA advisories naming AI or AI-agent software, list_ai_stack_vulnerabilities for the software AI agents run on, search_kev, and list_cyber_incident_filings for Item 1.05 disclosures.
Where an incident has an extortion, leak-site or travel-safety dimension, brief an advisor and we arrange a crisis response firm or an investigator with partners who work in that country.
Questions
Does this need a different incident response firm? Not a different kind of firm. Ask yours how it reconstructs a credential-driven intrusion that ran faster than a shift, and what log retention it expects.
Is this a new control requirement? No. Every check above was published before this research. Sophos's assessment is that "it is highly likely that other ransomware groups and their affiliates will embed AI agents like Cursor into their operations as well."
Is this legal advice? No. This page is a procedural checklist drawn from the public record. Counsel and your insurer decide what applies to your incident.