AI-Assisted Ransomware Operations Confirmed
Russian-speaking threat actors behind the Aurora (aka Aur0ra) ransomware operation have been observed using Cursor, an agentic AI coding assistant, to break into and compromise target networks, according to independent research from CloudSEK and Gambit Security.
What Happened
Both firms based their findings on exposed operator infrastructure, which revealed how the Cursor Agent — running Anthropic's Claude Sonnet underneath — was tasked directly with exploitation activity between April 8 and May 21, 2026. The campaign is confirmed against 10 targeted victims, with exposed infrastructure suggesting activity against more than 20 organizations across nine countries.
Named victims identified by Reuters include Christeyns, Teckentrup, the Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor, and an Italian manufacturer. Four organizations have appeared on Aurora's data leak site to date.
How Cursor AI Was Used
According to Gambit Security, operators directed the Cursor Agent to perform hands-on-keyboard style tasks normally requiring a skilled human operator, including:
- Installing and configuring VPNs and proxychains for covert access
- Scanning internal subnets with Nmap and NetExec
- Enumerating Active Directory domains and assessing privilege levels
- Executing NTLM relay attacks via PetitPotam, Coerce Plus, and PrinterBug
- Performing certificate-based attacks with Certipy against Active Directory Certificate Services
CloudSEK found that the operator planned attacks in Russian through the AI agent, deliberately excluding CIS IP ranges and CIS-country domains from targeting — a pattern consistent with other Russian-speaking cybercrime operations avoiding action against former Soviet states.
The Malware Itself
Both the Windows (sap.exe) and Linux/ESXi (encrypt.out) variants of Aurora's encryptor are static builds compiled from a single Zig codebase for different targets. Key capabilities include:
- Deletion of volume shadow copies and disabling of System Restore
- Termination of running virtual machines prior to encryption
- ESXi host discovery via a dedicated Python script (
esxi_finder.py)
Financial Model
Recovered encryption keys exposed the operation's affiliate structure: payment splits ranged from 54% to 79% of each ransom going to the affiliate who carried out the attack, with the remainder distributed among administrators. Laundering was traced through four cryptocurrency wallets with varying split ratios per victim.
Why This Matters
- AI lowers the skill floor for intrusion operations: tasks that once required an experienced penetration tester — subnet enumeration, NTLM relay chains, AD CS abuse — were driven through natural-language prompts to a coding agent.
- Guardrails are being tested in the field: this is one of the clearest documented cases of a commercial, mainstream AI coding assistant being directly tasked with live exploitation activity rather than just writing offensive tooling offline.
- Detection needs to account for AI-driven tempo: agentic tooling can execute reconnaissance and lateral movement steps faster and more consistently than manual operation, compressing the window defenders have to detect an intrusion in progress.
Recommendations for Organizations
- Monitor for anomalous outbound connections from developer tooling and coding assistants, especially where such tools have unexpected network or credential access.
- Harden Active Directory Certificate Services (AD CS) against known relay and certificate-based attack chains (PetitPotam, Certipy, coercion attacks) — these remain a common escalation path regardless of how the attack is orchestrated.
- Restrict and audit egress from internal segments to make Nmap/NetExec-style internal scanning easier to detect via network monitoring.
- Maintain offline, immutable backups and pre-tested VM/ESXi recovery procedures, given Aurora's explicit targeting of virtualization hosts.
- Track vendor AI-agent guardrail updates — commercial AI coding assistant providers are actively iterating on misuse detection, and organizations deploying these tools internally should stay current on abuse-prevention controls.
Source: The Hacker News