A threat intelligence report from Gambit Security has revealed that the Russian-speaking ransomware operation known as Aur0ra (Aurora) utilized the Cursor AI coding assistant to conduct hands-on network intrusions and automated exploitation across at least seven enterprise environments between April and May 2026.
According to session logs recovered from exposed threat actor infrastructure, the attacker drove Cursor Agent configured with the claude-4.5-sonnet-thinking model identifier to execute command-line network reconnaissance, credential harvesting, and privilege escalation tasks.
Agentic Exploitation Workflows
The recovered telemetry demonstrates an interactive attack cycle where the human operator provided target credentials and operational parameters, leaving tactical execution and error resolution to the agent:
- Network Reconnaissance and Enumeration: The agent deployed internal port scanning using Nmap and NetExec, and harvested Active Directory relationship graphs using BloodHound collectors.
- Authentication Coercion and Relay: Cursor Agent configured proxychains and SOCKS tunnels, executed authentication coercion using tools such as PetitPotam, Coerce Plus, and PrinterBug, and orchestrated NTLM relay attacks through Impacket's
ntlmrelayx. - Certificate Abuse: The agent executed Active Directory Certificate Services (AD CS) attacks using Certipy to escalate privileges across domain environments.
- Automated Retry Loops: When individual exploitation commands failed, the agent automatically analyzed terminal errors and generated syntactic or tactical modifications until commands succeeded.
The session logs indicate the human operator maintained explicit operational security constraints across target environments. The operator repeatedly instructed the agent in Russian to avoid DCSync commands, prevent account lockouts during password spray attempts, and refrain from creating new Active Directory computer objects that would trigger enterprise Security Information and Event Management (SIEM) detections.
ESXi Hypervisor Targeting
Alongside the AI-driven network intrusion activity, the investigation analyzed Aurora's Linux ransomware payload. The 139 KB ELF binary specifically targets VMware ESXi virtualized infrastructure:
- Uses
esxclito enumerate running virtual machines and terminate guest instances, releasing file locks on virtual disk files (.vmdk). - Encrypts virtual machine files in place using ChaCha20, protecting session keys with embedded RSA-4096 public keys.
- Preserves base hypervisor system volumes to ensure hosts remain bootable.
- Overwrites the ESXi SSH login banner with extortion demands so administrators view the ransom note upon connection.
The disclosure illustrates how general-purpose autonomous coding agents can be repurposed as real-time tactical assistants in offensive cyber operations, lowering the technical threshold required for complex Active Directory exploitation.
