Ransomware gang turns Cursor AI into attack aide

A Russian-speaking ransomware operation has used the Cursor artificial intelligence coding agent to support intrusions into corporate networks, exposing how commercial AI assistants can be manipulated to accelerate hacking once attackers gain access to a target.

Operators linked to the Aurora ransomware group employed Cursor Agent during hands-on exploitation of at least 10 organisations between April 8 and May 21, 2026. The AI system helped with network reconnaissance, privilege checks, vulnerability exploitation, credential attacks and the configuration of tools needed to move through compromised environments.

The activity offers one of the clearest documented examples of an agentic AI product being incorporated directly into ransomware operations rather than merely being used to generate malicious code or phishing messages. The attackers supplied credentials or existing routes into victim networks and then instructed the agent to complete specific technical objectives.

Cursor, developed by Anysphere and acquired by SpaceX this month, is designed primarily for software developers. Its agent capabilities can independently edit code, execute terminal commands and work through complex programming tasks. During the Aurora campaign, attackers used Cursor with Anthropic’s Claude Sonnet model to carry out or assist with security-related commands.

The group was able to turn those legitimate capabilities towards offensive operations. Instructions included identifying user privileges, enumerating Active Directory environments and scanning internal networks for accessible hosts. Tools such as Nmap, NetExec and BloodHound were used during parts of the activity.

Operators also directed the AI agent towards more aggressive techniques. These included attempts to conduct NTLM relay attacks by coercing authentication through tools such as PetitPotam, Coercer and PrinterBug. Cursor was additionally asked to support certificate-based attacks using Certipy, a widely used tool for assessing and exploiting weaknesses in Active Directory Certificate Services.

The AI did not operate as an autonomous ransomware attacker. Human operators controlled the engagements, supplied access information and repeatedly refined instructions when commands failed. Many tasks were unsuccessful on their first attempt, forcing the attackers to adjust commands, change scripts or try different techniques. Some eventually succeeded, while others produced only descriptions of unsuccessful attempts.

Chat records recovered from exposed attacker infrastructure also showed efforts to overcome safeguards built into the AI system. When Cursor rejected requests that appeared malicious, operators sometimes started new sessions or characterised their activity as authorised security testing. That approach allowed some previously blocked instructions to proceed.

At least seven companies were confirmed as having been compromised during the broader campaign. Identified victims included Belgian cleaning-products manufacturer Christeyns, Germany’s Teckentrup, which manufactures doors and gates, and Louisiana-based Bayou Title. The full number of affected organisations remains uncertain.

Separate analysis of the same exposed infrastructure uncovered evidence of activity affecting more than 20 organisations across nine countries between April and July. Attackers obtained domain-level or interactive access at 17 of those organisations, while four later appeared on Aurora’s public leak site.

The operation also displayed a significant development in Aurora’s ransomware capabilities. Investigators identified a Linux encryptor designed to target VMware ESXi environments, which are widely used to host multiple virtual machines on corporate infrastructure.

The malware encrypts files in place using the ChaCha20 encryption algorithm and protects session keys with an embedded RSA-4096 public key. It can identify ESXi hypervisors and VMware vCenter servers inside compromised networks before targeting virtual-machine data.

Aurora operators used a customised NetExec module to search directory information for VMware infrastructure. The ransomware can stop running virtual machines before encrypting their files while leaving essential ESXi system volumes untouched. Keeping the hypervisor operational allows administrators to access the system and view the ransom demand after virtual machines have been disabled.

The exposed files also contained exploit code covering at least a dozen vulnerabilities, much of it adapted from publicly available proof-of-concept material. Some tooling had been modified, while a FortiOS exploitation package appeared to have been rebuilt into a more specialised framework.

Aurora emerged as an active ransomware operation around April and has maintained a data-leak site used to pressure victims. Evidence from the recovered infrastructure indicates that at least one operator communicated and documented attack plans primarily in Russian while avoiding targets associated with Commonwealth of Independent States countries.