Aurora ransomware group abuses AI coding assistant in attacks

Aurora ransomware actors have been observed abusing SpaceX’s AI Cursor Agent to assist with post-compromise activities, according to research from Gambit Security’s Threat Intelligence team.

Between April 8 and May 26, 2026, the group used the tool, running Claude Sonnet, against 10 victims for tasks such as reconnaissance, installing VPN clients and running certificate attacks. Many commands failed on the first attempt, but some eventually succeeded.

The researchers also documented a new Linux ransomware variant targeting ESXi environments, which encrypts virtual machine files while keeping the hypervisor bootable. A second cluster of activity, attributed with medium confidence to an Aurora operator, targeted eight organisations across Israel, Germany, Austria, Spain, the US and Argentina.