Aurora Ransomware Group Used Cursor AI Agent in Network Intrusions

A Russian-speaking criminal group linked to the Aurora ransomware, also known as Aur0ra, used the AI agent built into the Cursor coding assistant for hands-on exploitation of victims' networks. The findings were published on August 31 by two threat intelligence firms, Israel's Gambit Security and India's CloudSEK, which independently uncovered traces of the operation.

According to the reports, Cursor Agent wasn't used to write the ransomware itself, but for hands-on actions during the intrusion. The operator would hand the agent valid login credentials or existing access to the victim's network, including SOCKS-based connections, and then task it with reconnoitering the environment, assessing privileges, scanning the internal network, and exploiting additional systems.

How the Agent Operated in Criminal Hands

Cursor Agent carried out tasks iteratively, requiring a series of successive commands, with the operator retaining control over decisions about the attack's next steps. VPN clients and ProxyChains were used to deploy access, while network reconnaissance relied on Nmap and NetExec. BloodHound, a tool also widely used legitimately by security teams, was used to map Active Directory structure.

The group employed advanced privilege escalation techniques, including NTLM relay attacks using PetitPotam, Coerce Plus, and PrinterBug, as well as abuse of Active Directory Certificate Services via the Certipy tool. Lateral movement across the victim's network occurred through the SMB, LDAP, WinRM, RDP, and RPC protocols, allowing the attackers to reach high-level administrator accounts.

From Phishing to Data Encryption

Initial access to victims' networks was often obtained by aggressively flooding employees' inboxes with emails, followed by phone calls in which attackers posed as IT department staff supposedly helping to resolve the problem. This tricked victims into installing the Xray-core remote access tool. Once they gained control of the network, the operators wiped system logs and disabled Microsoft Defender to make the attack harder to detect.

The final stage involved exfiltrating data and deploying an encryptor that used the ChaCha20 algorithm combined with an RSA-4096 key. CloudSEK identified both Windows and Linux versions of the Aurora ransomware, written in the Zig programming language, which is less commonly used in malware than C or Rust.

Fake Refusal, Real Attack

Cursor, like other commercial coding assistants, has built-in mechanisms that refuse to help with clearly criminal activity. According to Gambit Security, Aurora's operators bypassed these safeguards using the simplest possible method, telling the agent that the actions being carried out were a simulation or an authorized penetration test. The agent carried out the reconnaissance and exploitation commands without further verifying that claim.

Agent made the crew 30 to 50 percent faster - Eyal Sela, Director of Threat Intelligence, Gambit Security

It's another example of how agentic coding tools, designed to speed up developers' work, are becoming part of criminal groups' arsenal. Cases had already surfaced of Russian-speaking hackers tricking the Cursor agent with a security-test pretext to get help breaking into other companies. The Aurora case, however, shows a far broader, systematic scale of AI use across the operational cycle of a ransomware attack, from reconnaissance to deploying the encryptor.

Consequences for Businesses

For security teams, this means that monitoring network traffic alone is no longer enough, since part of the reconnaissance and exploitation now happens through a legally licensed development tool that is hard to distinguish from a developer's normal work. A 2026 Sophos report, cited in connection with the Aurora case, points to an average data recovery time after a ransomware attack of about three weeks and an average recovery cost of around $1.7 million; speeding up the intrusion phase by 30 to 50 percent directly cuts into defenders' response time.

Cursor, now developed under the wing of a company acquired by Elon Musk's SpaceX, has not yet publicly commented on the details described in the CloudSEK and Gambit Security reports. The case adds to a growing list of incidents showing that providers of agentic AI tools are still learning to block abuse that goes beyond simple text prompts and instead relies on multi-step, iterative control of the agent within a victim's real network.