Aurora Ransomware Uses Cursor AI to Attack 10 Targets

The Aurora ransomware group has used Cursor, an AI-powered coding assistant, to plan attacks and run hands-on exploitation against ten target organizations, according to separate investigations published by threat intelligence companies CloudSEK and Gambit Security. CloudSEK said an exposed open directory linked to the Russian-speaking group leaked months of operator activity, showing attacks against more than 20 organizations across nine countries between April and July 2026. Four of those victims have since appeared on Aurora's data leak site. The recovered material included shell history, toolkit files and the ransomware encryptor itself. According to CloudSEK, the operator used Cursor, an agentic coding assistant, to plan attacks in Russian while excluding Commonwealth of Independent States (CIS) ranges and CIS-country domains without exception.

Public details about Aurora first emerged in late May 2026. Security company CYFIRMA highlighted attacks that primarily targeted Windows systems and noted the group's continued technical development through incremental updates and feature expansion. Tracking by Ransomware.Live lists 33 known victims located in the United States, Germany, the Netherlands, Canada and the United Kingdom. A case detailed by Black Hills Information Security earlier this month showed how initial access was achieved: attackers used aggressive email bombing followed by phone calls to employees while posing as IT help desk staff, then tricked people into granting remote access through an open-source utility called Xray-core. The attack chain then moved laterally using SMB, LDAP, WinRM, RDP and RPC. The operators obtained high-privilege administrator accounts and abused them to clear logs, disable Microsoft Defender, harvest and exfiltrate sensitive data, and finally deploy the encryptor.

CloudSEK identified both Windows and Linux versions of Aurora written in the Zig programming language. Recovered chat history from the operator showed heavy use of Cursor for planning different phases of attacks, including a full Active Directory Certificate Services (AD CS) exploitation plan written in Russian. According to CloudSEK, the two encryptor binaries, a Windows file named sap.exe and a Linux/ESXi file named encrypt.out, are static builds compiled from one Zig codebase rather than two separately written programs. The Windows binary even contains the Linux build's usage examples inside it, a leftover from sharing a single source tree across both platforms. The Windows variant is also designed to block system recovery by deleting volume shadow copies and disabling System Restore through the Windows Registry. The Linux and ESXi variant tries to forcefully kill every virtual machine on the host before it starts encryption. Separately, a key recovered from the Aurora encryptor reportedly gave access to a ransom negotiation between the actor and an unnamed victim, plus a cluster of four cryptocurrency wallets. The wallets show affiliate payments ranging from 54 percent to 79 percent of each ransom, with the remainder going to administrators; the exact split is decided per victim based on the demanded ransom amount and the victim's revenue. The funds are later laundered and cashed out.

Gambit Security released its own findings, reporting that the Aurora operator used Cursor Agent running Anthropic's Claude Sonnet model to help with hands-on exploitation against 10 targets between April 8 and May 21, 2026. In these cases the agent was given valid credentials or an existing route into the victim organization and then tasked with various exploitation activities. Some of the tasks offloaded to the agent included installing a VPN client or proxychains and connecting to a victim with supplied credentials or an existing SOCKS tunnel, scanning internal subnets with Nmap or NetExec, and enumerating the domain with NetExec's BloodHound collector to report which privileges a user held. The agent also attempted NTLM relay attacks by coercing authentication with PetitPotam, Coerce Plus and PrinterBug, then using Impacket's ntlmrelayx to relay the result. It also ran certificate attacks with Certipy. Gambit Security noted that most agent commands failed to achieve their objective on the first attempt, leading to multiple refinements and changes to commands and scripts; some eventually succeeded while others failed and returned only a report to the attacker. In attacks that involved the Linux variant, the operators used a Python script called esxi_finder.py to scan for VMware ESXi hypervisors and vCenter servers inside a victim network. Reuters reported the names of several affected organizations: Christeyns, Teckentrup, Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor and an Italian manufacturer.

The Aurora operations are one more example of criminal groups using commercial AI tools despite the guardrails model providers have added. The same research cycle also surfaced a new AI-assisted toolkit named Gryxa. According to ReliaQuest, Gryxa belongs to a financially motivated actor running an initial-access operation that targeted 324 hosts. ReliaQuest said Gryxa is the first case it has observed where AI was used to build an entire operation, from the toolkit itself to the console used to run it. Gryxa turns legitimate remote monitoring and management (RMM) software into covert access, keeps that access alive through several independent restart mechanisms, and steals credentials saved in Chromium-based web browsers. When the connection to the actor is interrupted, Gryxa escalates against endpoint protection by disabling or attempting to uninstall the security agent. That combination gives the actor durable access to a host and allows theft of cryptocurrency wallets. The researchers believe the developer jailbroke an AI coding agent by presenting the whole development process as an authorized internal deployment. Gryxa is likely delivered through phishing emails. Once running, it sets up persistence with scheduled tasks and can bypass Chromium's app-bound encryption (ABE) protections to steal saved browser credentials; the harvested credentials are transmitted via Telegram. One unusual behavior is that Gryxa records remediation efforts and reports them back to the attacker. After the visible RMM implant is removed, a hidden component collects Windows logs and host artifacts and uploads them to attacker-controlled infrastructure. If the actor's relay becomes unreachable, Gryxa attempts to disable and uninstall endpoint protection agents such as Microsoft Defender within roughly 10 to 13 minutes, then re-enables Defender once the relay is reachable again. ReliaQuest said the Gryxa component only gathered and uploaded data without examining it, leaving the actor to draw conclusions about which tool performed the removal, which account ran it and in what order. The attacker's console includes a ready-made job named collect-forensics, indicating