Overview
Threat actors operating the Aurora (aka Aur0ra) ransomware have been caught using Cursor, SpaceX’s agentic AI coding assistant, to plan and execute intrusions against more than 20 organisations across nine countries between April and July 2026. Independent analyses by CloudSEK and Gambit Security, based on exposed operator infrastructure, reveal that the Russian-speaking group used Cursor’s AI capabilities to draft attack plans in Russian — including a full Active Directory Certificate Services (AD CS) exploitation strategy — marking one of the first confirmed cases of an agentic AI assistant being actively weaponised within a ransomware operation.
Technical Analysis
The exposed open directory leaked months of operator activity, including shell history, toolkit components, and both Windows and Linux encryptor binaries. Key findings include:
- Encryptors written in Zig: Both
sap.exe(Windows) andencrypt.out(Linux/ESXi) are static builds from a single shared Zig codebase compiled for different targets. The Windows binary contains Linux build artefacts, confirming a unified source tree. - Windows variant: Deletes volume shadow copies and disables System Restore via the Registry to inhibit recovery.
- Linux/ESXi variant: Force-kills all virtual machines on the host before initiating encryption.
- Initial access: Aggressive email bombing followed by vishing calls impersonating IT help desk staff, leading victims to install the open-source tunnelling utility Xray-core.
- Lateral movement: Conducted via SMB, LDAP, WinRM, RDP, and RPC; culminating in high-privilege administrator account compromise.
- Defence evasion: Log clearing and Microsoft Defender disablement before data exfiltration and encryption.
- Cursor AI usage: Recovered chat history shows the operator used Cursor to plan multiple attack phases in Russian, explicitly excluding CIS IP ranges and domains — a hallmark of Russian-nexus actors.
- Ransom infrastructure: A recovered key exposed a live ransom negotiation and four cryptocurrency wallets showing affiliate/operator revenue splits.
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| AML.T0047 | AI-Enabled Product or Service | Cursor used as an operational planning tool within the attack lifecycle |
| AML.T0065 | LLM Prompt Crafting | Operators crafted detailed exploitation plans via Cursor prompts |
| AML.T0103 | Deploy AI Agent | Cursor’s agentic capabilities leveraged for autonomous task planning |
| LLM08 | Excessive Agency | AI assistant acted on attack planning instructions without guardrails blocking malicious use |
| LLM02 | Insecure Output Handling | AI-generated attack code and plans were directly operationalised |
Impact Assessment
Aurora has listed 33 victims across the US, Germany, the Netherlands, Canada, and the UK on its data leak site. Four confirmed victims from the exposed directory have been publicly named. The dual-platform encryptor — targeting both Windows endpoints and Linux/ESXi hypervisors — broadens the potential blast radius to virtualised infrastructure. The use of Cursor AI to generate exploitation plans lowers the technical barrier for affiliates, potentially accelerating attack tempo.
Mitigation & Recommendations
- Restrict AI coding assistants in privileged or sensitive development environments; enforce acceptable use policies covering AI-assisted code generation.
- Harden AD CS configurations and deploy monitoring for common AD CS abuse patterns (ESC1–ESC8).
- Deploy vishing-aware training and enforce strict identity verification protocols before any remote access is granted by IT staff.
- Enable volume shadow copy protection and monitor registry changes that disable System Restore.
- Hunt for Xray-core and similar tunnelling tools across endpoints as indicators of initial access.
- Monitor for CIS geofencing exclusions in threat intelligence feeds as a signature of Russian-nexus actors.