Aurora Ransomware Gang Used the Cursor AI Coding Tool to Breach Ten Companies

Two security research teams have documented one of the clearest cases yet of AI ransomware attacks in the wild. A Russian-speaking crew running the Aurora ransomware operation used the Cursor coding assistant to help break into at least ten organisations this year. CloudSEK and Gambit Security published their findings in late August.

The discovery did not come from a tip-off. It came from a mistake. The operator left a directory of stolen data, tool logs and chat transcripts exposed on the open internet. Researchers found it.

What the exposed directory showed

CloudSEK says the leaked material covered months of activity. The group hit more than 20 organisations across nine countries between April and July. At 17 of those victims, the operator reached domain-level or interactive access. Four have since appeared on Aurora’s own leak site.

A separate Reuters investigation named six victims from the wider set. They include Belgian hygiene products maker Christeyns, German garage-door manufacturer Teckentrup, and Scotland-based Helideck Certification Agency. The list also covers an Argentine pharmaceutical distributor, an Italian manufacturer, and Bayou Title, a Louisiana title insurance company. Of those, Bayou Title has been confirmed on Aurora’s leak site, generally a sign the victim did not pay.

Gambit Security’s analysis focused on a narrower slice: 28 chat sessions between the operator and Cursor’s AI agent. These covered hands-on exploitation against ten targets between 8 April and 21 May. That detail is why the story has drawn attention. It shows an AI coding tool being used step by step to run an intrusion, not just to draft phishing text offline.

How the operator used the AI agent

The operator worked in Russian. Per CloudSEK, the operator “used Cursor, an agentic coding assistant, to plan attacks in Russian, while excluding CIS ranges and CIS-country domains, without exception”. That exclusion rule is a long-standing habit among Russian-speaking ransomware crews. It reduces the risk of local prosecution by avoiding former Soviet states.

Gambit found that a simple trick got past the model’s built-in safety refusals. The operator simply told the agent the work was a simulation, or an authorised penetration test. Once that framing was in place, the agent carried out standard tasks. It installed VPN clients, scanned networks with Nmap and NetExec, and enumerated domain privileges, then attempted NTLM relay and certificate-based attacks.

The results were not flawless. Gambit noted that “the majority of the commands failed to achieve the stated objective on the first attempt, resulting in multiple refinements”. A human still had to read the output and correct course. Even so, the tool made the crew somewhere between 30 and 50 percent faster, by Gambit’s estimate, at work they could already do by hand. That gap is what makes AI ransomware attacks worth tracking as a category, even where the underlying method stays the same.

The tradecraft behind the AI ransomware attacks

Strip away the AI angle and the technique list reads like a standard internal penetration test playbook. NetExec handled LDAP and SMB discovery. Kerberoasting and ASREPRoasting stole credentials. BloodHound-style enumeration mapped domain trust paths. The noPac chain and NTLM relay via PetitPotam, PrinterBug and DFSCoerce moved the operator sideways. The operator also abused Active Directory Certificate Services weaknesses, tracked as ESC1, ESC6 and ESC8, to mint certificates for privileged accounts.

None of that is new. Every item on the list has been public knowledge, with published detection guidance, for at least two years. What changed is the speed. That speed is the real story behind most AI ransomware attacks so far.

What the ransomware did

Once inside, the group deployed two encryptor binaries built from a single Zig codebase. A Windows build was named sap.exe, and a Linux/ESXi build was named encrypt.out. The Windows version deletes volume shadow copies before encrypting. The ESXi version forcibly kills running virtual machines with esxcli. It then encrypts VM disk and configuration files with ChaCha20 and RSA-4096 key wrapping, while leaving the host’s own system volumes untouched so the machine keeps booting.

Victims are left with a blunt message through the compromised system’s SSH banner: “We have downloaded confidential information files. Your files are encrypted”. Under Aurora’s affiliate model, whoever ran the intrusion keeps between 54 and 79 percent of any ransom paid, with the rest going to the operation’s administrators.

What this means for defenders

The uncomfortable part of this story for IT managers and CISOs is not that criminals have a new AI tool. It is that none of the fixes have changed. Aurora’s affiliate got through because the identity and certificate weaknesses were already sitting on the network. The AI did not find anything a scanner would have missed. It just worked through the checklist faster than a human typically would. This is likely what most AI ransomware attacks will look like for the next few years: familiar techniques, run at speed.

Three checks are worth prioritising after a story like this. First, audit Active Directory Certificate Services templates for the ESC1, ESC6 and ESC8 misconfigurations, then lock down who can enrol against them. Second, enforce SMB signing and Extended Protection for Authentication, so NTLM relay attempts fail outright. Third, treat unusual LDAP enumeration or BloodHound-style queries as an alert, not background noise. That pattern shows up early in almost every domain compromise.

Faster tooling shortens the time between initial access and full compromise. That argues for shorter detection and response windows, not a new category of defence.