Aurora, the ransomware that uses Cursor: months of attacks designed with Claude Sonnet

The open directory of an infrastructure linked to the Aurora group allowed CloudSEK and Gambit Security to reconstruct months of activity: more than twenty organizations hit between April and July 2026, ten targets against which Cursor's agent was used, and an encryptor written in Zig for Windows, Linux, and ESXi. The recovered chat logs show that the operator planned the attacks in Russian and assigned Claude Sonnet concrete operational tasks, not just generic scripts.

Infrastructure exposure and recorded victims

CloudSEK identified an open directory that exposed months of activity by the Russian-speaking group known as Aurora or Aur0ra. The data lists more than twenty organizations in nine countries, attacked between April and July 2026; four victims later appeared on the group's data leak site. The operator used Cursor to plan the attacks in Russian, unconditionally excluding IP addresses and domains from the Commonwealth of Independent States countries.

Aurora emerged publicly in late May 2026, when CYFIRMA described its attacks mainly targeting Windows systems and a continuous update of capabilities. According to the Ransomware.Live website, as of 31 August 2026 there are 33 recorded victims, concentrated mainly in the United States, Germany, the Netherlands, Canada, and the United Kingdom.

The names of the affected companies have not been disclosed by the security firms, but Reuters indicated Christeyns, Teckentrup, Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor, and an Italian manufacturer.

The attack chain from email bombing to the encryptor

Black Hills Information Security reconstructed a case in early August 2026. Initial access was obtained through aggressive email bombing, followed by phone calls in which the attacker impersonated IT help desk personnel. After convincing the victim, the group established remote access through Xray-core, an open-source utility.

From there the chain continues with lateral movement via SMB, LDAP, WinRM, RDP, and RPC, acquisition of high-privilege administrator accounts, log deletion, and disabling of Microsoft Defender. Only then do sensitive data exfiltration and distribution of the encryptor take place.

How the operator uses Cursor Agent against the ten targets

Gambit Security observed the Aurora operator using Cursor Agent, which runs Anthropic's Claude Sonnet, for practical exploitation activities against ten targets between 8 April and 21 May 2026. In these cases the agent was given credentials or an already existing access path to the victim organization, then exploitation tasks were assigned.

Sometimes the attacker only asked the agent to achieve a goal, for example "tell me what rights the user has". In other cases he specified the tool to use or instructed it to follow a pre-generated attack plan. In some situations the agent proposed a list of next steps and the attacker replied with a number.

The delegated tasks included:

• installation of a VPN client or proxychains, configuration and connection to the victim with provided credentials or through an existing SOCKS tunnel;
• scanning of internal subnets with Nmap or NetExec;
• domain enumeration to report the privileges of a specific user, using NetExec's BloodHound collector;
• attempted NTLM relay attacks by forcing authentication with PetitPotam, Coerce Plus, and PrinterBug, using Impacket ntlmrelayx to forward the resulting authentication;
• certificate attacks with Certipy.

Most commands did not achieve the goal on the first attempt: continuous refinements to commands and scripts were needed. Some eventually succeeded, others failed and returned only a report of the attempts to the attacker.

The chat logs also show a complete Active Directory Certificate Services exploitation plan written in Russian, a sign that Cursor was used to design entire phases of the campaign.

The shared Zig encryptor for Windows, Linux, and ESXi

CloudSEK identified Windows and Linux versions of Aurora written in Zig. The two binaries — sap.exe for Windows and encrypt.out for Linux/ESXi — are static builds derived from a single Zig codebase compiled for different targets, not a separate rewrite. The Windows binary contains within it usage examples of the Linux build, a remnant of a shared source tree.

The Windows variant prevents system recovery by deleting volume shadow copies and disabling System Restore directly via the Registry. The Linux/ESXi variant instead attempts to forcefully terminate every single virtual machine present on the host before starting encryption.

In campaigns involving the Linux version, a Python script called esxi_finder.py was used to locate VMware ESXi hypervisors and vCenter servers in the victim network.

A key recovered from the encryptor reportedly allowed access to a ransom negotiation and a cluster of four cryptocurrency wallets. The data shows variable splits: affiliates receive between 54% and 79% of the ransom, a share decided per victim based on the amount demanded and the organization's revenue; the rest goes to the administrators.

Gryxa, the AI-built toolkit used against 324 hosts

ReliaQuest discovered a distinct toolkit, called Gryxa, used by a financially motivated actor for an initial access operation against 324 hosts. According to the researchers, it is the first observed case in which AI built the entire operation, from the toolkit to the management console.

Gryxa turns legitimate remote monitoring and management software into covert access, maintains persistence with independent restart mechanisms, and steals credentials saved in Chromium-based browsers. When the connection with the attacker is interrupted, it attempts to disable or uninstall the endpoint protection agent, for example Microsoft Defender, within 10-13 minutes. When the relay becomes reachable again, it re-enables Defender.

Evidence indicates that the actor jailbroken an AI coding agent, presenting the development as an "authorized internal deployment". The toolkit is probably distributed via phishing email; once executed, it sets persistence with scheduled tasks and can bypass Chromium's app-bound encryption protections. Collected credentials are transmitted via Telegram.

The most unusual aspect is the recording of remediation activities: after removal of the visible RMM implant, a hidden component collects Windows logs and host artifacts and uploads them to the attacker's infrastructure. The console includes a predefined job called collect-forensics, indicating a routine capability, not a response to a single incident. Gryxa rotates log files when they exceed 200 KB, preserving recent activity for rapid responders.

Defense: what to look for and why guardrails are not enough

No specific mitigation recommendations have been published by the researchers. The technical picture still offers useful indicators for defenders: traffic to Xray-core, presence of Nmap, NetExec, BloodHound, Certipy, or Impacket ntlmrelayx, attempted NTLM relay attacks, and anomalous changes to shadow copies or the Registry. In the case of Gryxa, unauthorized RMM processes, suspicious scheduled tasks, and the sending of archives via Telegram should be monitored.

The Aurora case shows that AI model providers' guardrails did not prevent the operational use of Cursor Agent. The attacker did not have to write original exploits: he provided the agent with already valid access and guided it with goals, numbers, and pre-generated plans. The risk is not AI becoming autonomous, but AI lowering the cost of each individual step inside an already compromised network.