Gambit Security’s threat intelligence team has published a detailed account of the Aurora ransomware operation, including six weeks of session logs showing an operator driving SpaceX’s Cursor AI coding agent through hands-on exploitation inside ten target organizations between April 8, 2026 and May 21, 2026. Reuters, which first reported the findings on August 27, 2026, put the number of confirmed breached companies at at least seven.
The investigation, authored by Gambit’s director of threat intelligence Eyal Sela and published August 27, 2026, rests on exposed infrastructure associated with the group, which has operated a data leak site and been reported active since roughly April 2026. The recovered material shows the operator running Cursor Agent with the model identifier claude-4.5-sonnet-thinking against live enterprise networks, and it reads less like an attack script than like a junior intruder working a shift with a senior engineer on call.
What the Cursor Sessions Show
In the victim networks where the agent was used, the operator handed Cursor Agent credentials or an existing route in, then tasked it with exploitation work: installing and configuring VPN clients or proxychains to connect through supplied credentials or an existing SOCKS tunnel; scanning internal subnets with Nmap or NetExec; enumerating domain privileges with NetExec’s BloodHound collector; coercing authentication for NTLM relay attacks with PetitPotam, Coerce Plus, and PrinterBug, relayed through Impacket’s ntlmrelayx; and running certificate attacks with Certipy.
The interaction pattern is the part worth sitting with. Sometimes the operator gave only an objective, such as reporting what rights a supplied user held. Sometimes the agent proposed next steps and the attacker simply replied with the number of one. Most commands failed on the first attempt, and the agent iterated through refinements until some tasks succeeded and others ended as a report of failed attempts. That is the same failure-and-retry loop any developer knows from agentic coding, transplanted onto a victim’s network.
The operator also imposed the same three operational-security constraints at every victim, in Russian, repeatedly: no DCSync, restated in at least five messages as categorically forbidden; no account lockouts, attached to every password-spray or guessing request; and no adding new computer objects to the domain. Whoever this was understood that those three actions are what gets an intrusion caught, and drilled the agent on them like a checklist.
A Linux Encryptor Built for ESXi
The report’s other half is a Linux variant of the Aurora ransomware, recovered as a 139 KB ELF binary hosted on Cloudflare R2 and copied manually onto multiple internal hosts in a victim environment. It encrypts files in place with ChaCha20, wrapping each session key with an embedded RSA-4096 public key, and it carries a dedicated ESXi mode.
In that mode the encryptor enumerates running virtual machines with esxcli, force-kills each guest to release locks on virtual disk files, then encrypts VM files while skipping the hypervisor’s system volumes — deliberately leaving the host bootable so the victim can read the ransom demand. It also writes the extortion text into the SSH login banner, so anyone connecting to the machine sees the demand before the login prompt. A custom NetExec LDAP module, esxi_finder.py, scanned victim networks for ESXi hypervisors and vCenter servers, fingerprinting exact builds over TLS. Gambit published file hashes, command-and-control addresses, SOCKS proxy infrastructure, and the group’s negotiation portal and clearnet leak site as indicators of compromise.
A Second Cluster With Different Tradecraft
Gambit also attributes a second activity cluster to an Aurora operator with medium confidence, possibly a different person. The link is an exfiltration bucket that received data from an organization Aurora published on its leak site nine days later. This cluster spans eight victim organizations across Israel, Germany, Austria, Spain, the United States, and Argentina, and it skips the caution of the first: lateral movement through exposed SQL Server xp_cmdshell, escalation to SYSTEM with GodPotato, DCSync against the domain controller, and exfiltration with s5cmd to self-hosted S3-compatible storage. The contrast matters: one operator avoiding DCSync religiously while another runs it suggests a crew with uneven discipline rather than a single playbook.
The AI-Assisted Intrusion Pattern Is Recurring
Gambit has been tracking this shape of intrusion for months. Its April 10, 2026 technical report documented a single operator running two AI platforms against nine government agencies, and its August 2026 research on AI across the intrusion lifecycle mapped how AI assistance is spreading through each phase of real-world attacks. The Black Kite 2026 ransomware report similarly describes a faster, more fragmented threat economy. The Aurora logs are the most granular public evidence yet of what that looks like at the keyboard: not AI generating malware, but AI as an always-available exploitation consultant that lowers the skill floor for hands-on network intrusion.
The disclosure also lands at an awkward moment for the tool’s new owner. Cursor — which bills itself as the coding agent “for building ambitious software,” its own site says — formally became part of SpaceX on August 14, 2026, closing a $60 billion acquisition two weeks before the report’s publication. Gambit’s findings do not allege any failure in Cursor’s systems; the agent appears to have been a paid or otherwise ordinary tool, abused through ordinary access. The record Gambit published now gives defenders concrete infrastructure to block and hunt against, and gives the industry a documented case of an agentic coding product run end-to-end as attack tooling.
Credit: Source link
