Aurora ransomware actors leverage AI tool for exploitation campaigns

Per Infosecurity Magazine, threat actors associated with Aurora ransomware have been observed exploiting SpaceXAI's Cursor Agent tool to facilitate their exploitation campaigns. A study by Gambit Security's Threat Intelligence team revealed that these actors used Claude Sonnet through Cursor Agent to aid in various malicious activities against at least 10 victims between April 8 and May 26, 2026.

The Aurora ransomware group utilized Cursor Agent for post-compromise activities, providing it with credentials or existing access to victim networks. Tasks included environmental reconnaissance, such as scanning for hosts and identifying user privileges, and deploying exploitation tools like NetExec and Nmap. The actors also directed Cursor Agent to perform certificate attacks using Certipy and install VPN clients or proxychains. While the AI tool did not always succeed on the first attempt, requiring multiple refinements, its use demonstrates a trend of threat actors experimenting with AI to enhance campaign efficiency.

The Gambit study also noted Aurora's deployment of a new Linux ransomware variant targeting VMware ESXi environments, capable of encrypting virtual machine files while keeping the hypervisor bootable to display ransom demands. Aurora ransomware activity has been ongoing since April 2026, with the group targeting organizations globally and operating a data leak site.

Source: Infosecurity Magazine