Ransomware Gangs Hand Hacking Work to AI Agents, Researchers Say
Sophos and Check Point say criminals are now letting AI agents map networks, steal credentials and hunt targets with little human direction.
Cybercriminals are increasingly handing large parts of their attacks to artificial intelligence agents, according to new research from two major security firms. The agents are software that can plan and carry out multistep tasks on their own. Sophos, the British cybersecurity company, says a ransomware group let AI agents roam inside victim networks, harvest passwords and reach top-level administrator access with little human direction. Separately, Check Point Research, the threat intelligence arm of Israel-based Check Point Software, documented criminals running fleets of AI agents that attacked hundreds of targets almost entirely by themselves.
Neither firm describes fully automated ransomware, in which a machine handles everything from break-in to extortion. But both reports suggest that the hardest and most time-consuming parts of a hack are increasingly being done by machines, which lowers the skill needed to pull them off.
What researchers found inside a ransomware operation
Sophos’s Counter Threat Unit tracks the group behind Aur0ra ransomware under the name GOLD OGRE. Ransomware is malicious software that locks or steals an organization’s data so criminals can demand payment. According to Sophos, its researchers recovered files from the AI coding assistant Cursor dating to late August 2026. The files showed operators giving AI agents VPN login details, proxy access, a list of targets and objectives.
From there, the agents did much of the legwork, Sophos said. They:
- mapped victims’ networks and Active Directory, the Microsoft system many companies use to manage user accounts;
- searched file shares, documents, backups and cloud storage for passwords;
- tried common credential attacks and rewrote their own commands and scripts when attempts failed;
- moved from machine to machine with limited human involvement.
In some networks the agents reached domain administrator access, effectively the keys to the whole corporate network. Help Net Security, a cybersecurity news site, reported that three of those victims were later named on Aur0ra’s data leak site, where gangs post stolen information to pressure organizations into paying. Humans still handled the initial break-in and the final ransomware deployment, Sophos said.
Help Net Security quoted one instruction an operator gave an agent: “Don’t try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors.”
How the attackers got around AI safeguards
Sophos said the operators slipped past the safety rules built into commercial AI models by telling the systems that the intrusions were authorized “red team” exercises, the simulated attacks that companies hire testers to carry out, or diagnostic testing. The group first relied almost exclusively on models from Anthropic, then added models from Elon Musk’s xAI and the Chinese company Moonshot, as well as Cursor’s own Composer model, according to Sophos. The firm linked that change to a shift from building tools to running live intrusions. Keyboard slips in Cyrillic found in the operators’ logs suggest they are Russian speakers, Sophos said.
Sophos also assessed “with high confidence” that GOLD OGRE first used AI to test whether its tools could avoid detection by endpoint security products, then gave similar technology to its associates. Help Net Security noted that Gambit Security and CloudSEK, two other security firms, published separate analyses based on the same exposed server.
Agent fleets on autopilot
Check Point’s report, published Nov. 5, looked at ARTEX, an open-source, AI-powered penetration-testing platform developed in China. Penetration testing is authorized hacking meant to find security holes. The tool uses large language models to coordinate several agents that plan tests, run hacking tools and record their findings. Check Point said its developer took the project closed-source on Oct. 8 after it was linked to attacks on South Korean banks, but copies of the original code remain public and criminals are using them.
Researchers found 1,608 live, publicly reachable ARTEX control panels. “Most attacks were fully autonomous besides the initial goal setup,” Check Point wrote. The results were mixed. One operator collected more than 300 Apple iOS signing certificates from gray-market shops, three of which passed every validity check. Another harvested more than 190,000 login credentials for the Chinese mobile game Honor of Kings, about 6,000 of which Check Point estimated were still active. A third campaign against nearly 300 cryptocurrency payment sites failed to steal any money, and some of the agents’ conclusions were not backed by evidence. Check Point did not link ARTEX to ransomware.
What comes next
Sophos said it is “highly likely” that other ransomware groups and their affiliates will build AI agents into their operations, warning that AI “can accelerate phases of the attack chain and reduce the level of technical aptitude needed to conduct an attack.” Still, the firm said standard defenses still work: patching internet-facing devices, using phishing-resistant multifactor authentication, watching security alerts and responding quickly. It also recommended separating critical servers, isolating backups and limiting administrator privileges. Check Point warned that organizations with exposed systems should expect a high volume of automated attacks and should test and harden them.
