Aurora ransomware used Cursor AI to plan network attacks

Aurora ransomware operators used Cursor, an AI-powered coding assistant, to plan and carry out intrusions into victim networks, according to findings from CloudSEK and Gambit Security. The two firms carried out independent analyses of exposed infrastructure belonging to the Russian-speaking cybercrime group, and their work uncovered its toolkit, its command history and its encryptor, the program that locks a victim's files. The group is also tracked as Aur0ra.

CloudSEK said the exposed open directory leaked "months of activity" aimed at more than 20 organizations across nine countries between April and July 2026. Four of those victims have since been listed on the group's data leak site, the public page where ransomware crews post stolen material to pressure victims into paying. CloudSEK noted that the operator used Cursor to plan attacks in Russian while excluding CIS ranges and CIS-country domains, without exception. CIS stands for the Commonwealth of Independent States, a group of countries in Eastern Europe and Central Asia.

Details about Aurora first emerged in late May 2026, when CYFIRMA highlighted attacks that mainly targeted Windows systems and the group's continued technical development through incremental updates and new features. Data from Ransomware.Live lists 33 victims located in the United States, Germany, the Netherlands, Canada and the United Kingdom.

In one case detailed by Black Hills Information Security earlier this month, the attackers gained their first foothold through aggressive email bombing, then telephoned employees while posing as IT help desk staff offering to help with the flood of messages. Instead, they used an open-source utility called Xray-core to establish remote access. From there the attack chain moved laterally using SMB, LDAP, WinRM, RDP and RPC, the standard Windows mechanisms for sharing files, looking up directory information, running commands on other machines, taking over a remote desktop and calling services on another system. The intruders obtained high-privilege administrator accounts and abused them to evade detection by clearing logs and disabling Microsoft Defender, before harvesting and exfiltrating sensitive data and deploying the encryptor.

CloudSEK said it identified both Windows and Linux versions of Aurora written in Zig, a programming language. Recovered chat history shows heavy use of Cursor for planning various phases of the attack, including a full exploitation plan for Active Directory Certificate Services (AD CS), the Microsoft system that issues digital certificates inside a corporate network, written in Russian. CloudSEK noted that both encryptor binaries, the Windows sap.exe and the Linux/ESXi encrypt.out, are static builds from a single Zig codebase, compiled for different targets rather than written twice. The Windows binary even carries the Linux build's usage examples inside it, a leftover from sharing one source tree across both platforms, the company said.

The Windows variant is also equipped to inhibit system recovery by deleting volume shadow copies, the automatic snapshots Windows keeps so that files can be restored, and by disabling System Restore directly through the Registry, the database of Windows settings. The Linux and ESXi variant attempts to forcefully kill every single virtual machine on the host before starting encryption.

A key recovered from the Aurora encryptor is said to have granted access to a ransom negotiation between the threat actor and an unspecified victim, and to a cluster of four cryptocurrency wallets that show varying splits between affiliates and the main operators. Affiliates received between 54% and 79%, with the rest going to the administrators. This indicates that the affiliate share of the ransom is decided per victim and depends on the amount demanded and the victim's revenue figures, according to the findings. The illicit funds are then laundered and cashed out.

Gambit Security, which released its own insights into the activity, said it observed the Aurora operator using Cursor Agent, running Anthropic's Claude Sonnet model, to help with hands-on exploitation against 10 targets between 8 April and 21 May 2026. "In these cases the agent was given credentials or an existing route into the victim organization. Then it was tasked with various exploitation activities," Eyal Sela, director of threat intelligence at Gambit Security, said.

The tasks handed to the AI agent included installing a VPN client or proxychains (a tool that routes traffic through a chain of intermediary servers) and connecting to a victim with supplied credentials or an existing tunnel; scanning internal subnets for hosts with Nmap or NetExec; enumerating the domain to report which privileges a supplied user holds, using NetExec's BloodHound collector; attempting NTLM relay attacks, a technique that captures and reuses a Windows authentication exchange, by coercing authentication with PetitPotam, Coerce Plus and PrinterBug and relaying the result with Impacket ntlmrelayx; and running certificate attacks with Certipy. In some cases the attacker simply asked for an objective, such as telling them what rights a user had, while in others they named the tool to use or told the agent to follow an attack plan it had generated earlier. Sometimes the agent returned a list of possible next steps and all the attacker did was reply with a number.

Gambit said the majority of the commands failed to achieve the stated objective on the first attempt, which led to multiple refinements and changes to the commands and scripts used for each task. Some eventually succeeded, while others failed and returned only a report of the attempts to the attacker. Attacks involving the Linux version have also used a Python script named esxi_finder.py to scan for VMware ESXi hypervisors and vCenter servers inside a victim network.

The names of the affected companies were not disclosed in the technical reports, but Reuters said they include Christeyns, Teckentrup, Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor and an Italian manufacturer.

Aurora is not the only recent case of criminal groups leaning on commercial AI tools. ReliaQuest said it discovered a new AI-assisted toolkit called Gryxa, used by a financially motivated threat actor to run an initial-access operation targeting 324 hosts. ReliaQuest described Gryxa as the first case it has observed where AI was used to build an entire operation, from the toolkit itself to the console it is run from.

According to ReliaQuest, Gryxa turns legitimate remote monitoring and management (RMM) software into covert access, keeps that access alive through several restart mechanisms that operate independently of each other, and then steals credentials saved in Chromium-based browsers. It also escalates against endpoint protection when the connection to the attacker is interrupted, disabling or attempting to uninstall the security agent.