Threat researchers at CloudSEK and Gambit Security have separately documented how operators of the Aurora ransomware (also tracked as Aur0ra) used Cursor, an AI-powered coding assistant, to help plan and carry out intrusions against real organizations. Exposed infrastructure left an open directory containing the group’s toolkit, shell history, and encryptor — leaking months of activity that CloudSEK says targeted more than 20 organizations across nine countries between April and July 2026, with four victims later posted on the group’s leak site. The operators excluded CIS-country IP ranges and domains from their targeting without exception — a common pattern among Russian-speaking cybercrime groups to avoid domestic law enforcement attention.
Gambit Security’s analysis focused specifically on Aurora’s use of Cursor Agent, running Anthropic’s Claude Sonnet, against 10 targets between April 8 and May 21, 2026. In those cases, the attacker fed the AI assistant existing credentials or network access and tasked it with exploitation steps: enumerating Active Directory permissions, planning AD Certificate Services (ADCS) abuse, and choosing attack tools. “In some cases, the attacker only asked the agent to achieve an objective, such as ’tell me what rights the user has,’” said Eyal Sela of Gambit Security. “In others, the Agent gave a list of potential next steps — and all the attacker did was reply with a number corresponding to one of them.” The Aurora encryptor comes in both Windows and Linux/ESXi variants, written in Zig from a single shared codebase. The Windows build deletes volume shadow copies and disables System Restore; the Linux and ESXi variant kills all running virtual machines before encrypting. An affiliate model divides ransoms between operators and affiliates, with affiliate cuts ranging from 54% to 79% of each payment.