Aurora Operators Use the Cursor AI Assistant to Breach Networks

Researchers at CloudSEK and Gambit Security independently examined the exposed infrastructure of the Russian-speaking ransomware group Aurora (also known as Aur0ra). An unsecured directory revealed, in CloudSEK's words, “months of activity”: the toolkit, the shell command history and the encryptor itself. Between April and July 2026, the group attacked more than 20 organizations across nine countries.

The most striking finding is the use of Cursor, an agentic AI coding assistant. According to CloudSEK, an operator used it to plan attacks in Russian while scrupulously excluding CIS-country IP ranges and domains from the targets. The recovered correspondence included, among other things, a complete plan for exploiting Active Directory Certificate Services, written in Russian.

AI as the operator

Gambit Security documented how an Aurora operator used Cursor Agent, powered by Anthropic's Claude Sonnet, for hands-on exploitation against 10 targets between April 8 and May 21, 2026. The agent was handed credentials or ready-made access to a victim's network, and then given tasks: set up a VPN or proxychains, scan subnets with Nmap and NetExec, enumerate user privileges with the BloodHound collector, run NTLM relay attacks (PetitPotam, PrinterBug, Impacket) and certificate attacks via Certipy.

Sometimes the attacker simply stated a goal such as “find out what rights this user has,” and sometimes named a specific tool. In a number of cases the agent itself proposed a list of next steps, leaving the human only to reply with the number of the desired option. That said, most commands failed on the first try and required repeated revisions — some tasks eventually succeeded, others returned nothing but a report of failed attempts.

An encryptor written in Zig

The analysts uncovered Windows and Linux versions of Aurora written in the Zig language from a single codebase. The Windows variant (sap.exe) even carries inside it usage examples from the Linux build — a trace of the shared source tree. The Windows version deletes volume shadow copies and disables system recovery via the registry; the Linux/ESXi variant tries to forcibly shut down all virtual machines on the host before encrypting.

The recovered key opened access to the ransom negotiations and to four crypto wallets. The group's affiliate share ranges from 54% to 79% depending on the ransom amount and the victim's revenue, with the rest going to the administrators.

And yet another AI toolkit

In parallel, ReliaQuest described a new kit called Gryxa — by its assessment, the first case in which the entire toolkit and management console were built end to end with AI. The developer, according to the researchers, bypassed the AI agent's safeguards by passing the work off as a “sanctioned internal deployment.” Gryxa turns legitimate RMM software into a covert access channel, steals credentials from Chromium-based browsers and exfiltrates them via Telegram, and disables Microsoft Defender when it loses contact with the operator.

What's described here is one more example of attackers leaning on commercial AI tools, despite the tightening restrictions imposed by the model developers.

Source: The Hacker News