Aurora ransomware: when an AI coding assistant helps the attackers
An attacker is already inside a company’s network. Instead of typing commands themselves, they open a code editor and write, in Russian: connect to the network, find the servers, check what these accounts can do. An AI agent gets to work. This isn’t science fiction: according to security researchers, that’s how an Aurora ransomware affiliate used the AI agent in Cursor, a mainstream code editor, during real intrusions.
This isn’t a robot hacking on its own. But the lesson is clear for any business adopting AI tools: an agent that can run commands is privileged access, and it needs to be managed that way.
Key takeaways
- Between April 8 and May 21, 2026, an Aurora affiliate used Cursor’s AI agent against 10 organizations, according to Gambit Security.
- The AI handled reconnaissance and attempted privilege escalation. The attacker provided the access, called the shots and deployed the ransomware themselves.
- Most of the agent’s commands failed on the first attempt: the AI sped the attacker up, it didn’t replace them.
- For your business: an AI agent that can run commands is privileged access. Manage it that way.
One attacker’s mistake exposed everything
Aurora (also known as Aur0ra) is a Russian-speaking ransomware group active since around April 2026. It works with “affiliates,” attackers who carry out the intrusions and split the ransom with the group.
The story came out because one of those affiliates made a mistake: they left one of their own servers open to the internet, with no protection. Security firms CloudSEK and Gambit Security found the attacker’s tools, command history, ransomware… and their conversations with Cursor’s AI agent. Both analyses were published on August 27, 2026. On September 1, the Cloud Security Alliance (CSA) followed with a research note and recommendations.
The key numbers:
- Between April 8 and May 21, 2026, the affiliate used Cursor’s agent, powered by Anthropic’s Claude Sonnet model, against 10 organizations, according to Gambit Security.
- In total, CloudSEK ties the same affiliate to more than 20 organizations in 9 countries between April and July 2026. The attacker gained domain-level or interactive access at 17 of them.
- Ransomware.Live lists 33 Aurora victims, including in the United States, Germany, the Netherlands, Canada and the United Kingdom, The Hacker News reports.
- In the fastest case, barely two weeks passed between the attacker’s access and the victim appearing on the group’s leak site.
Who did what: the AI or the attacker?
The recovered conversations show a fairly clear split of roles. The agent did the repetitive reconnaissance work; the attacker kept control of the decisions and of the endgame.
| Stage | What the AI did | What the attacker did |
|---|---|---|
| Initial access | Nothing: the agent started from access the attacker already had. | Gave the agent valid credentials or an existing route into the victim’s network. |
| Connection | Installed and configured a tunnel or VPN to connect to the target network. | Handed the agent specific tasks, written in Russian. |
| Reconnaissance | Scanned the internal network to find computers and servers, and checked what privileges the stolen accounts held in Active Directory. | Picked from the next steps the agent suggested, sometimes by simply replying with a number. |
| Escalation | Attempted to gain administrator rights, for example by abusing the company’s internal certificates. | Gave the AI their own “guardrails”: no noisy techniques, nothing that might lock out the stolen accounts. |
| Data theft and encryption | Nothing documented: the attacker took over again. | Went back to their usual tools: stole data in 50 GB batches, then deployed the ransomware on Windows and VMware ESXi. |
Based on Gambit Security, CloudSEK and the Cloud Security Alliance.
One key point: according to Gambit Security, most of the agent’s commands failed on the first attempt. They had to be corrected, sometimes several times. In other words, the AI didn’t replace an experienced attacker. It sped them up.
Aurora ransomware: from breached network to ransomware
Once they had administrator rights, the attacker went back to their usual tools. They stole data, compressed in 50 GB batches according to CloudSEK, then deployed the ransomware. Aurora comes in two versions: one for Windows, which deletes local backup copies (shadow copies) before encrypting, and one for VMware ESXi virtualization servers, which force-stops virtual machines so it can encrypt them.
CloudSEK also notes that at one victim, the attacker had validated the credentials for the backup system. That’s a classic sign that encryption is about to happen: if the backups go down, the business has no plan B.
And the initial access? It isn’t documented for every victim. But in another Aurora case described by Black Hills Information Security and reported by The Hacker News, attackers first flooded employees with emails, then called them posing as IT support to install a remote access tool.
What Aurora ransomware means for your business
Not a multinational? Most of the lessons still apply, especially if your team already uses coding assistants, AI agents or automation tools.
The CSA puts it well: a coding agent that can run commands behaves exactly like a person typing in a terminal. So it should be treated as privileged software, not just a productivity tool. The CSA also points out that you can’t rely only on AI vendors’ safeguards, since they didn’t prevent weeks of abuse.
6 practical steps against Aurora ransomware
1. Take stock of AI tools that can take action
List the coding assistants, AI agents and automations that can run commands, read files or connect to your systems. A tool installed without approval by an employee or contractor counts too.
2. Give them as few rights as possible
No administrator accounts, no production passwords in an agent session, and access only to the systems a task actually needs. That’s the principle of least privilege, applied to AI.
3. Keep records and watch for suspicious behaviour
Keep agent session histories the same way you keep administrator access logs. Endpoint detection and response (EDR) spots suspicious behaviour, like a network scan or a new tunnel, whether it comes from a person or an AI.
4. Lock down the front door
Turn on multi-factor authentication (MFA) everywhere, especially on VPN and remote access, and keep those devices patched. As our article on the Citrix NetScaler zero-days showed, remote access appliances are a prime target. Finally, set one simple rule: IT support will never call you out of the blue to install software without a way to verify it.
5. Isolate your backups from Aurora ransomware
Use separate credentials for your backup system, keep at least one offline or immutable copy, and test your restores. If you run VMware ESXi servers, their management console shouldn’t be reachable from the employee network.
6. Plan your response to Aurora ransomware
Know who to call and what to unplug if you’re attacked. The Canadian Centre for Cyber Security offers a practical ransomware playbook, and you can report an incident to the Centre online. If personal information may have been affected, Quebec’s Law 25 requires you to document the incident and assess the risk of serious injury.
How NeoTech can help
At NeoTech Cloud Solutions, our cyber monitoring plans include advanced endpoint protection (EDR) managed by us, automated 24/7 monitoring and, depending on the plan, response from our on-call technician. We also help Greater Montreal SMBs adopt AI with the right guardrails, in English and French.
Book your free cyber check
Do you know which AI tools have access to your systems? Would your backups survive a ransomware attack? In one short meeting, we’ll go through it with you, and you’ll walk away with a clear list of priorities. No jargon, no commitment.
Prefer to talk to us directly? Call 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Cloud Security Alliance: Aurora Ransomware’s Abuse of Cursor AI: Security Implications and Guidance (September 1, 2026)
- Gambit Security: Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation (August 27, 2026)
- CloudSEK: Caught in 4K: The Aurora Files (August 27, 2026)
- The Hacker News: Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets (August 31, 2026)
- Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)
Photo credits: Negative Space (Pexels, CC0) and Derrick Coetzee (CC0), via Wikimedia Commons. Timeline and table: NeoTech Cloud Solutions.