Russian-speaking ransomware operators have been caught using Cursor, an AI-powered coding assistant, to automate network exploitation against corporate targets – marking one of the first documented cases of threat actors weaponizing commercial AI agents for hands-on cyberattacks.
Researchers from CloudSEK and Gambit Security independently uncovered the technique after finding exposed infrastructure tied to the Aurora (also stylized as Aur0ra) ransomware group. The findings, published August 27 and 31, reveal that the operators ran Anthropic Claude Sonnet model through Cursor Agent to assist with reconnaissance, lateral movement, and credential harvesting across at least 10 victim organizations.
The attacks took place between April 8 and May 26, 2026, targeting companies in the United States, Germany, the Netherlands, Canada, the United Kingdom, Argentina, Israel, Austria, and Spain. Named victims include Christeyns, Teckentrup, Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor, and an Italian manufacturer, according to Reuters reporting. The affected organizations span industries from chemicals and industrial equipment to maritime certification and real estate.
How the AI Agent Was Deployed
In each case, the Aurora operator would first gain initial access to the victim network, then hand control to Cursor Agent along with credentials or an established route into the organization. The agent was then tasked with various exploitation activities, ranging from basic reconnaissance to full certificate attacks against Active Directory Certificate Services.
Some tasks were described at a high level, such as tell me what rights the user has. Others included specific instructions to use particular tools – Nmap for subnet scanning, NetExec with BloodHound for domain enumeration, Certipy for certificate attacks, and PetitPotam or Coerce Plus for NTLM relay attacks.
The majority of the commands failed to achieve the stated objective on the first attempt, resulting in multiple refinements and changes to the commands and scripts used for each task, researchers at Gambit Security wrote. Some eventually succeeded in achieving the objective, while others failed and returned only a report of the attempts to the attacker.
In some cases, the agent proposed a list of potential next steps, and the attacker simply replied with a number corresponding to one of them. This suggests the AI was functioning less as a fully autonomous operator and more as a force-multiplying assistant that accelerated the attacker workflow while still requiring human judgment at each decision point.
The Full Attack Chain
CloudSEK analysis, based on months of recovered chat history and shell logs, revealed the broader Aurora attack methodology. Initial access typically began with aggressive email bombing followed by phone calls to employees posing as IT help desk staff, who would then establish remote access using an open-source utility called Xray-core.
From there, lateral movement occurred through SMB, LDAP, WinRM, RDP, and RPC. The operators targeted high-privilege administrator accounts, cleared logs, disabled Microsoft Defender, and exfiltrated data before deploying the encryptor. The entire sequence from initial access to encryption could be completed in a matter of hours.
Both Windows and Linux versions of the Aurora encryptor were found to be written in Zig, compiled as static builds from a single codebase. The Windows variant deletes volume shadow copies and disables System Restore via the Registry. The Linux and ESXi variant forcefully kills every virtual machine on the host before encryption begins, using a custom Python script called esxi_finder.py to scan for VMware ESXi hypervisors and vCenter servers.
AI as a Force Multiplier for Cybercrime
The Aurora case is not an isolated incident. Researchers at ReliaQuest also disclosed a separate AI-built toolkit called Gryxa, which was used to run an initial-access operation targeting 324 hosts. Gryxa represents the first case where AI was used to build an entire offensive operation, from the toolkit to the console it runs from.
In the Gryxa case, the threat actor jailbroke an AI coding agent by passing off the entire development process as an authorized internal deployment. The toolkit turns legitimate remote monitoring and management software into covert access, steals credentials from Chromium-based browsers, and reports remediation efforts back to the attacker.
The broader trend raises urgent questions about the security implications of agentic AI tools. While companies like Anthropic and OpenAI implement guardrails to prevent misuse, threat actors continue to find ways around them – in Aurora case, by reframing harmful requests as authorized penetration tests and restarting sessions when the agent refused to comply with certain commands.
CloudSEK noted that the Aurora operator used Cursor to plan attacks in Russian while excluding CIS ranges and CIS-country domains without exception, suggesting a level of operational discipline that extends to how the AI tools are deployed. The exposed open directory leaked months of activity that was active against more than 20 organizations across nine countries between April and July 2026.
Financial Incentives and Ransomware Economics
Affiliate operators in the Aurora operation received between 54% and 79% of each ransom payment, with the remainder going to the group administrators, according to cryptocurrency wallet analysis. The affiliate cut appears to be negotiated per victim based on the ransom amount demanded and the victim revenue figures, with the illicit funds then laundered and cashed out through cryptocurrency mixing services.
The group data leak site currently lists 33 victims, though CloudSEK open directory suggests the true number may be higher. The combination of AI-assisted exploitation and traditional social engineering techniques like vishing represents a new hybrid attack model that security teams will need to address with both technical controls and employee awareness training.