Full Report
Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its
Analysis Summary
# Incident Report: Aurora Ransomware Exploitation via Cursor AI
## Executive Summary
Russian-speaking threat actors associated with the **Aurora (Aur0ra)** ransomware group have been observed utilizing **Cursor**, an AI-powered coding assistant, to facilitate and automate network exploitation. The group targeted over 20 organizations globally between April and July 2026, leveraging AI agents to conduct reconnaissance and plan Active Directory attacks. The campaign resulted in at least 10 confirmed exploitation attempts and the listing of multiple victims on a data leak site.
## Incident Details
- **Discovery Date:** August 2026 (Public reporting by CloudSEK and Gambit Security)
- **Incident Date:** April 8, 2026 – July 2026
- **Affected Organization:** Multiple (10+ targeted, 33 total listed by Ransomware.Live)
- **Sector:** Multi-sector (including IT and Virtualized Infrastructure)
- **Geography:** Global (US, Germany, Netherlands, Canada, UK; excluding CIS countries)
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing April 2026
- **Vector:** Email Bombing / Social Engineering (IT Help Desk Impersonation)
- **Details:** Attackers used aggressive email bombing to overwhelm targets, followed by phone calls posing as IT support. They persuaded employees to install **Xray-core**, an open-source utility, to establish remote access.
### Lateral Movement
- **Details:** Once inside, attackers moved through the network using standard protocols including **SMB, LDAP, WinRM, RDP, and RPC**. They specifically targeted **Active Directory Certificate Services (AD CS)** for escalation.
### Data Exfiltration/Impact
- **Details:** Sensitive data was harvested and exfiltrated before the deployment of the Aurora encryptor. The encryptor targeted both Windows and Linux/ESXi environments, forcefully killing virtual machines (VMs) and deleting volume shadow copies.
### Detection & Response
- **Discovery:** Researchers discovered an exposed open directory belonging to the threat actors, revealing months of shell history and chat logs.
- **Response Actions:** Independent analyses by CloudSEK and Gambit Security led to the identification of the group's toolkit and crypto-wallets.
## Attack Methodology
- **Initial Access:** Email bombing, Vishing (Voice Phishing), and Xray-core utility.
- **Persistence:** Remote access via Xray-core.
- **Privilege Escalation:** Exploitation of Active Directory Certificate Services (AD CS).
- **Defense Evasion:** Clearing logs, disabling Microsoft Defender, and using AI to generate evasion strategies.
- **Credential Access:** Harvesting high-privilege administrator accounts.
- **Discovery:** Using **Cursor AI (Claude Sonnet)** to query user rights and map network permissions.
- **Lateral Movement:** SMB, LDAP, WinRM, RDP, RPC.
- **Collection:** Automated data harvesting.
- **Exfiltration:** Exfiltration to attacker-controlled infrastructure before encryption.
- **Impact:** Zig-based ransomware; Windows variant deletes shadow copies; Linux variant kills ESXi VMs.
## Impact Assessment
- **Financial:** Ransom demands varied; affiliate cuts ranged from 54% to 79% of the total ransom.
- **Data Breach:** Sensitive corporate data exfiltrated and posted to a public leak site.
- **Operational:** Significant disruption to virtualized environments (ESXi) and Windows systems.
- **Reputational:** Public listing of at least four organizations on the Aurora leak site.
## Indicators of Compromise
- **File indicators:**
- `sap.exe` (Windows Encryptor)
- `encrypt.out` (Linux/ESXi Encryptor)
- **Behavioral indicators:**
- Use of **Cursor AI agent** for hands-on exploitation.
- Installation of `Xray-core` on workstations.
- Mass deletion of Volume Shadow Copies and disabling of System Restore.
## Response Actions
- **Containment:** Organizations are advised to block traffic related to known Aurora infrastructure.
- **Eradication:** Removal of Xray-core and unauthorized Zig-based binaries.
- **Recovery:** Restoration from off-site backups (due to shadow copy deletion).
## Lessons Learned
- **AI-Enhanced Phishing:** Attackers are now using AI to translate plans and automate "hands-on-keyboard" tasks, lowering the barrier for complex exploitations like AD CS attacks.
- **Multi-Platform Targeting:** The use of the **Zig** programming language allows attackers to maintain a single codebase for both Windows and Linux/ESXi, increasing development efficiency.
- **Human Element:** Social engineering via phone calls remains a highly effective bypass for technical controls.
## Recommendations
- **AI Policy:** Monitor or restrict the use of AI coding assistants (like Cursor) within production environments to prevent unauthorized agentic activity.
- **Identity Security:** Harderning Active Directory Certificate Services (AD CS) to prevent the specific escalation paths planned by this group.
- **Help Desk Verification:** Implement strict call-back or out-of-band verification procedures for IT support interactions.
- **Offline Backups:** Maintain immutable, off-site backups to mitigate the impact of ransomware that targets volume shadow copies.