Aurora ransomware operators use Cursor AI in attacks on 10 targets

Threat actors behind Aurora ransomware have been observed using the AI-powered coding assistant Cursor to break into target networks, according to analyses from CloudSEK and Gambit Security. The findings are based on exposed infrastructure that leaked months of activity against more than 20 organisations across nine countries between April and July 2026.

The operators used Cursor to plan attacks in Russian, including a full Active Directory Certificate Services exploitation plan, and to assist with hands-on exploitation against 10 targets. Tasks offloaded to the agent included attempting NTLM relay attacks and coercing authentication with tools like PetitPotam and Impacket ntlmrelayx.

The Windows and Linux versions of the encryptor are static builds from a single Zig codebase. The Windows variant deletes volume shadow copies and disables System Restore, while the Linux and ESXi variant kills virtual machines before encryption. Affiliates receive between 54% and 79% of ransom payments, with the rest going to the operators.

The development is the latest example of attackers relying on commercial AI tools, and follows the discovery of the AI-assisted toolkit Gryxa used for initial access operations. Gryxa turns legitimate remote monitoring software into covert access, steals credentials from Chromium-based browsers, and can disable endpoint protection when the connection to the actor is interrupted.