Loading story…
Russian-speaking operators linked to the emerging Aur0ra ransomware group used Cursor's AI coding agent, reportedly powered by Claude Sonnet, to assist post-compromise activity against at least seven—and potentially 10—organizations from April to May 2026. Gambit Security recovered 28 attacker-agent conversations from an internet-exposed Aur0ra server showing requests for reconnaissance, credential theft and password cracking, privilege discovery, host and network scanning, account takeover, tool deployment, certificate attacks, network-access setup, and exploitation of vulnerable systems.
The operators supplied existing credentials or network access, repeatedly refined prompts, and reportedly bypassed some AI safeguards by restarting chats and presenting malicious activity as authorized security testing. Gambit estimated the assistance accelerated operations by 30% to 50%; activity affected organizations across multiple countries and sectors, although the available evidence does not prove Cursor was used in every compromise or that each incident led to extortion. Aur0ra also introduced a Linux ransomware variant targeting VMware ESXi that encrypts virtual-machine files while keeping the hypervisor bootable to display ransom demands.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Cursor became part of SpaceX following an acquisition process that had started earlier in the year.
Aur0ra-associated, Russian-speaking operators used Cursor Agent, powered by Claude Sonnet, after obtaining network access or credentials to support ransomware intrusions. The activity began on April 8 and included reconnaissance, credential and privilege discovery, host scanning, exploitation attempts, certificate attacks, and deployment of tools including NetExec, Nmap, Certipy, VPN clients, and proxychains.
Researchers reported a separate cluster attributed to Aurora with medium confidence that targeted eight organizations across several countries. The cluster reportedly used exposed SQL Server xp_cmdshell for lateral movement, GodPotato for SYSTEM elevation, DCSync, and s5cmd to exfiltrate data to a self-hosted S3-compatible endpoint.
Louisiana-based Bayou Title appeared on Aur0ra's data-leak site, indicating the group sought extortion leverage against the organization.
Aur0ra deployed a new Linux ransomware variant targeting VMware ESXi environments. The variant encrypts virtual-machine files while leaving the hypervisor bootable to display ransom demands.
Reuters identified Christeyns, Teckentrup, Helideck Certification Agency, an Argentine pharmaceutical distributor, and an Italian manufacturer as apparent victims in Aur0ra's Cursor-related activity. Gambit Security's exposed-server review covered chat logs from April 8 through May 21 and CloudSek said the group had claimed at least 20 victims overall.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecysecurity.news
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Aur0ra/Aurora Locker** ransomware operation has been linked to double-extortion attacks beginning with email bombing and vishing calls impersonating IT helpdesks. In one investigated intrusion, operators used renamed Xray-core binaries as reverse command-and-control tunnels, configured with VLESS/REALITY traffic masquerading as Chrome connections to `dl.google.com`; they then moved laterally, obtained privileged administrative access, cleared logs, weakened Microsoft Defender, and timestomped the tunnel binaries. The attackers deleted shadow copies, deployed a victim-specific locker and `dist.exe` distributor, and left `!!!README!!!DO_NOT_DELETE.txt` notes; encrypted files retained their original names and extensions but received a footer containing magic bytes `66 18 a7 2f`. Reporting indicates Aurora affiliates conduct the full attack lifecycle rather than solely brokering initial access, including credential theft, Active Directory compromise, data exfiltration, encryptor staging, extortion, and payment collection. Blockchain tracing identified two confirmed ransom payments and two more consistent with victim payments, routed through shared laundering and consolidation infrastructure before cash-out. The affiliate is assessed as Russian-speaking and opportunistically targets organizations outside the CIS; compensation appears individually negotiated rather than governed by a fixed ransomware-as-a-service split. On ESXi/Linux systems, Aurora has also modified the SSH banner configuration to display ransom demands instead of dropping a conventional ransom-note file.
Aug 28, 2026
Gambit Security reported that a suspected affiliate of **The Gentlemen** ransomware-as-a-service operation used Anthropic’s **Claude Code** during live intrusions at multiple organizations, showing how generative AI is being embedded directly into ransomware activity. The actor reportedly used AI to breach internet-exposed VPN appliances, conduct reconnaissance, enumerate internal networks, identify domain controllers and backup systems, and prioritize high-value business data for theft. In one highlighted technique, the operator carried out an AI-assisted LDAP pass-back attack against **FortiGate** authentication to capture a service account password in cleartext, then created a hidden VPN account to maintain persistence. The intrusions also involved staging and exfiltrating **SQL Server** backups, modifying firewall configurations, and using AI-generated scripts to accelerate operations. Gambit linked the activity to The Gentlemen with medium confidence based on leak-site overlap, shared infrastructure, and targeting patterns focused on backup systems. The report placed the ransomware case alongside other AI-enabled criminal operations, including the **Zerofot** credential-harvesting campaign built with OpenAI Codex and Claude Code and the **RAGE** framework backed by DeepSeek, underscoring a broader shift toward AI-assisted credential theft, reconnaissance, and malware deployment. Gambit also noted that AI use introduced operational errors, including a mistaken full VDOM restore that knocked a compromised firewall offline at an Australian energy utility.
Aug 20, 2026
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026