Aurora Ransomware Hackers Use Cursor AI Agent for Arms-On Exploitation and ESXi Assaults

Aurora ransomware operators have been noticed utilizing Cursor Agent, powered by Claude Sonnet, to help hands-on intrusion exercise throughout ten sufferer organizations, whereas deploying a purpose-built Linux encryptor designed to disrupt VMware ESXi environments.

The findings present how ransomware associates are integrating agentic AI into established post-compromise workflows somewhat than counting on it as a standalone assault functionality.

The uncovered setting supplied visibility into the actor’s tooling, assault workflow, and an ESXi-capable ransomware pattern named encrypt.out, with SHA-256 a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe.

Between April 8 and Could 21, 2026, the Aurora operator used Cursor Agent with claude-4.5-sonnet-thinking in a number of sufferer environments.

The actor equipped the agent with legitimate credentials or an present route, together with SOCKS-based entry, then instructed it to hold out reconnaissance, privilege evaluation, inner scanning, and exploitation duties.

The recovered periods point out that the operator used AI as an iterative technical assistant. In some circumstances, the attacker requested broad questions, akin to figuring out a person’s efficient privileges.

In others, the operator directed the agent to make use of particular offensive instruments or comply with a prebuilt assault plan.

The agent usually wanted a number of command revisions earlier than a process succeeded, underscoring that the human operator remained in command of execution and decision-making.

Noticed duties included deploying VPN shoppers and ProxyChains, scanning inner networks with Nmap and NetExec, amassing Lively Listing info with BloodHound.

Trying NTLM relay assaults with PetitPotam, Coerce Plus and PrinterBug, and conducting Lively Listing Certificates Companies assaults by way of Certipy.

The operator repeatedly instructed the AI to not carry out DCSync, keep away from account lockouts, and chorus from including pc objects to the area operational constraints apparently meant to scale back detection threat and stop disruptive adjustments earlier than encryption.

Aurora’s Linux payload was hosted on Cloudflare R2 and manually copied to inner sufferer hosts. The malware encrypts information in place utilizing ChaCha20 and encrypts every session key with an embedded RSA-4096 public key.

Its command-line choices help partial encryption, file-size limits, worker-thread management, folder concentrating on, and a devoted -esxi mode.

Gambit Safety’s Risk Intelligence crew uncovered Cursor, uncovered infrastructure linked to the Aurora operation, which has been energetic since about April 2026 and operates a public data-leak web site.

Cursor AI-Powered Ransomware

When executed with the ESXi choice, encrypt.out runs esxcli vm course of listing to enumerate energetic visitor digital machines and acquire their World IDs.

NetExec pushed LDAP and SMB discovery, password coverage retrieval, ASREPRoasting, Kerberoasting the identical sequence, the identical output file naming conference, each time.

It then force-terminates every visitor by way of esxcli vm course of kill –kind=drive –world-id=, releasing locks on digital disk recordsdata earlier than encrypting them. Focused recordsdata embody VMDK, VMX, VMSD, VMSN, NVRAM, VMEM, VSWP and log recordsdata.

Notably, the malware avoids ESXi system volumes akin to BOOTBANK* and OSDATA*. That selection leaves the hypervisor bootable, enabling directors to entry the host and encounter the extortion demand after the digital machines have been taken offline.

Aurora writes the ransom message to /and so forth/ssh/sshd-banner, presenting it to directors earlier than the SSH login immediate.

The group additionally used esxi_finder.py, a customized NetExec LDAP module, to find ESXi and vCenter infrastructure.

The module identifies inner subnets by way of Lively Listing or an operator-provided vary listing, scans ports 443 and 902, examines TLS certificates for ESXi signatures, and queries /sdk, /ui/, and root paths to fingerprint the VMware product and decide precise construct variations.

Separate analysis by CloudSEK linked an uncovered listing to a Russian-speaking Aurora affiliate energetic towards greater than 20 organizations throughout 9 international locations from April by way of July.

The listing held credential materials, Kerberos tickets, shell historical past, Cursor chat logs, customized NetExec modules, and Home windows and Linux Aurora lockers compiled from a shared Zig codebase. 4 recorded victims later appeared on Aurora’s leak web site.

CloudSEK and TRM Labs additionally traced a settled sufferer fee by way of shared laundering infrastructure, figuring out two confirmed Aurora sufferer funds and two further flows according to separate victims.

The proof helps the evaluation that the actor operated as a direct ransomware affiliate, progressing from entry and area compromise to information theft, encryption, and extortion somewhat than merely brokering community entry.

The marketing campaign highlights the necessity to deal with ESXi platforms, Lively Listing Certificates Companies, backup infrastructure, and distant administration paths as high-priority ransomware publicity factors.

Organizations ought to isolate administration networks, prohibit SSH and ESXi entry, monitor esxcli vm course of kill exercise, implement SMB signing and Prolonged Safety for Authentication, and audit AD CS templates for ESC1, ESC6, and ESC8 misconfigurations.

Aurora’s operational mannequin additionally reinforces a broader concern: AI brokers can decrease the time and ability required for iterative post-exploitation, however they don’t eradicate the necessity for stolen credentials, legitimate entry paths, and conventional offensive tooling.

On this case, the AI part accelerated an already mature ransomware workflow constructed round Lively Listing compromise, lateral motion, information theft, and virtualization-layer disruption.

IOCs

Be aware: IP addresses and domains are deliberately defanged (e.g., [.]) to stop unintended decision or hyperlinking. Re-fang solely inside managed menace intelligence platforms akin to MISP, VirusTotal, or your SIEM.

★ Which Safety Instruments Ought to You Minimize? Rating Them on One Web page – Obtain the Inherited Safety Stack Information