Aurora ransomware operator used Cursor agent to plan attacks on 20+ organizations
An exposed directory belonging to a Russian-speaking Aurora ransomware affiliate revealed the operator used Cursor, an AI coding assistant, to plan attacks against over twenty organizations across nine countries between April and July 2026. The operator deployed Aurora ransomware including a Linux variant targeting ESXi environments, with payment evidence linked through shared laundering infrastructure.
What happened
An exposed open directory served without authentication on port 8888 revealed months of activity from a Russian-speaking Aurora ransomware affiliate. The directory contained the operator's toolkit, shell history, and the Aurora encryptor binary with ransom note and onion address embedded.
Between April and July 2026, the operator compromised more than twenty organisations across nine countries, achieving domain-level or interactive access at seventeen of them. The operator used Cursor, an agentic coding assistant running Claude Sonnet, to plan attacks in Russian while excluding CIS ranges and CIS-country domains.
The operator deployed a Linux variant of Aurora ransomware capable of targeting ESXi environments, with samples hosted on Cloudflare R2 and manually copied into victim environments. The encryptor uses ChaCha20 encryption with RSA-4096 key wrapping and includes options for selective file encryption, thread configuration, and ESXi-specific targeting.
Reported impact
Four of the identified victims were subsequently listed on Aurora's public leak site. In partnership with TRM Labs, CloudSEK traced ransom payments on-chain and found them converging through shared laundering infrastructure, with TRM identifying two confirmed victim payments and two further payments consistent with separate victims.
Index analysis
The operator demonstrated a repeatable Active Directory compromise playbook and deployed the encryptor directly rather than selling access onward, indicating operational maturity beyond the point of simple access broker activity. CloudSEK assessed with high confidence that the operator is a Russian-speaking Aurora affiliate operating directly.
The use of Cursor Agent to assist with exploitation represents an unusual integration of commercial AI coding tools into ransomware attack planning and execution workflows.
Governance controls
CloudSEK initiated coordinated notification to relevant national CERTs and uncompromised victims ahead of publication on 27 August 2026, holding publication until notification could proceed. TRM Labs reviewed the on-chain findings independently before publication.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.