Aurora operators drove Cursor Agent through ten victim networks over six weeks
Gambit Security says the ransomware crew used a commercial coding agent for hands-on post-compromise work between 8 April and 21 May, alongside a new Linux encryptor that force-kills running guests before it touches ESXi datastores.
The Watch · Security desk
What happened
- Gambit Security says it found exposed Aurora ransomware infrastructure and observed the operator using Cursor Agent, running Claude Sonnet, for hands-on exploitation across ten target organisations from 8 April to 21 May 2026.
- A Linux variant called encrypt.out was hosted on Cloudflare R2 and copied by hand onto internal hosts, encrypting in place with ChaCha20 under an embedded RSA-4096 public key.
- A second cluster, attributed to an Aurora operator with medium confidence, targeted eight organisations across Israel, Germany, Austria, Spain, the US and Argentina.
Why it matters
- What's now possible capability The skill floor for post-compromise Active Directory work drops when an operator with valid credentials can outsource the trial and error to something that rewrites its own commands until one lands.
- Who's exposed exposure Recovery pressure moves from endpoint to cluster: one host with esxcli reach converts into every guest on it, and the encryptor deliberately leaves the hypervisor running so the demand is the first thing an admin sees.
- What it limits constraint Defenders cannot treat hypervisor inventory as internal-only detail when a NetExec module is harvesting exact build strings off 443 and 902 from inside the domain.
- What doesn't add up contradiction The end date and the ownership of Cursor Agent differ between the vendor post and the trade coverage, so the whole timeline currently rests on a single research team's telemetry.
Next story · Invest · Oct 9
One operator used a free pentest agent and Claude Code to breach as many as nine Korean banksConfirmed4 publishers
Gambit's researchers say the majority of commands failed to achieve their stated objective on the first attempt, forcing repeated refinements to the commands and scripts, with some tasks eventually succeeding and others returning only a report of what had been tried [14]. The pattern is repeated iteration rather than independent decision-making: the operator handed over credentials or an existing route and let the agent iterate [2], and a failed attempt costs little more than tokens.
Ten target organisations between 8 April and 21 May 2026 [1] is a 44-day span, an average of one new environment every 4.4 days [21]. Gambit plotted the sessions with one row per organisation and circle area standing for command volume [10]. Some prompts were bare objectives, one of them quoted as "tell me what rights the user has"; others named the exploitation tool or told the agent to follow an attack plan generated earlier [3].
The hypervisor tooling is further along than the agent work. esxi_finder.py, a custom NetExec LDAP module, learns internal subnets by querying the domain controller and resolving computer objects, or reads them from an operator-supplied ranges file [9]. It then hits ports 443 and 902, checks the TLS certificate for an ESXi signature, and pulls /sdk, /ui/ and / to fingerprint the product and extract the exact build [12]. That returns a versioned inventory before anything is deployed. The encryptor itself, encrypt.out, was hosted on Cloudflare R2 and copied by hand onto multiple internal hosts [15]. In ESXi mode it collects World IDs with esxcli vm process list and force-kills each guest, releasing the locks that running VMs hold on their virtual disks [7]. It encrypts vmdk, vmx, vmsd, vmsn, nvram, vmem, vswp and log files while skipping BOOTBANK and OSDATA volumes, so the hypervisor stays bootable and the demand can be read [8]. The note is written to /etc/ssh/sshd-banner, which puts the onion address in front of anyone who SSHes to a host nobody looks at [20].
The named toolset is built entirely from public kit: domain enumeration, NetExec's BloodHound collector and Nmap subnet scans [4], PetitPotam, Coerce Plus and PrinterBug coercion into NTLM relay, Certipy for certificate attacks [5], and a VPN client or proxychains over supplied credentials or an existing SOCKS tunnel [6]. The agent supplies sequencing, and its retries generate more attempts per objective [14], giving defenders more chances to catch it, not fewer. An ESXi host logging a burst of esxcli vm process kill --type=force has already told you the encryptor is resident [7].
On dating, the two accounts diverge. Gambit's own post gives the session window as 8 April to 21 May 2026 [1]; Infosecurity Magazine reports it as 8 April to 26 May and describes Cursor Agent as SpaceX's product [23]. Gambit published on 27 August, 98 days after the last session it says it observed [22], so the window is a floor for what has been running, not a boundary. The medium-confidence second cluster covers eight organisations in Israel, Germany, Austria, Spain, the US and Argentina [17][18].
What to watch
- Whether the vendors behind Cursor Agent and Claude Sonnet disclose account enforcement or session telemetry tied to this operator.
- Whether Gambit upgrades the medium-confidence second cluster to firm attribution, widening Aurora's confirmed footprint by eight organisations.
- Whether an ESXi-specific initial access route appears, using the build numbers esxi_finder.py collects rather than domain credential reuse.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption60
- Hype gap+22
- Incentives58
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Gambit observed the Aurora operator using Cursor Agent, running Claude Sonnet, to assist with hands-on exploitation across ten target organisations between 8 April and 21 May 2026.
- [2]
In some victim networks the operator used Cursor Agent with claude-4.5-sonnet-thinking; the agent was given credentials or an existing route into the victim organisation and then tasked with exploitation activities.
- [3]
In some cases the attacker only asked Cursor Agent to achieve a stated objective, such as "tell me what rights the user has"; on other occasions specific instructions named which exploitation tool to use or told the agent to follow a previously generated attack plan.
- [4]
Commands given to the agent included enumerating the domain to report which privileges a supplied user holds, using NetExec's BloodHound collector, and scanning internal subnets for hosts with Nmap or NetExec.
- [5]
Cursor Agent was tasked with attempting NTLM relay attacks by coercing authentication with PetitPotam, Coerce Plus and PrinterBug, and with running certificate attacks using Certipy.
- [6]
The agent was told to install a VPN client or proxychains, configure it, and connect to a victim with supplied credentials or an existing SOCKS tunnel.
- [7]
With the -esxi flag, the sample runs esxcli vm process list to collect the World ID of each running virtual machine, then esxcli vm process kill --type=force --world-id=<world-id>; killing the guests releases locks on virtual disk files held by the running VMs so the encryptor can encrypt them.
- [8]
The ESXi mode encrypts virtual machine files (vmdk, vmx, vmsd, vmsn, nvram, vmem, vswp, log) and skips system volumes (BOOTBANK*, OSDATA*), which keeps the hypervisor itself bootable so the victim can read the ransom demand.
- [9]
esxi_finder.py, a custom NetExec LDAP module, finds VMware ESXi hypervisors and vCenter servers inside a victim network, first learning internal subnets either by querying the domain controller over LDAP and resolving computer objects or from an operator-supplied ranges file.
- [10]
Gambit's chart plots Cursor Agent sessions between 8 April and 21 May 2026 with one row for each target or victim organisation, and circle area representing the number of commands.
- [11]
Gambit Security's Threat Intelligence team identified exposed infrastructure associated with the Aurora ransomware group, providing visibility into the group's operations across multiple victim environments.
- [12]
esxi_finder.py scans ports 443 and 902, reads the TLS certificate for an esxi signature, and pulls /sdk, /ui/ and / to fingerprint the product and extract the exact build.
- [13]
Aurora ransomware activity has been reported as active since approximately April 2026, with the group operating a data leak site and targeting organisations across multiple countries.
- [14]
Gambit researchers wrote that the majority of commands failed to achieve the stated objective on the first attempt, resulting in multiple refinements and changes to the commands and scripts used for each task; some eventually succeeded, while others failed and returned only a report of the attempts to the attacker.
- [15]
The Linux Aurora sample encrypt.out (SHA-256 a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe) was hosted on Cloudflare R2 and copied manually into multiple internal hosts in a victim environment.
- [16]
The sample encrypts file contents in place with ChaCha20 and wraps each session key with an embedded RSA-4096 public key.
- [17]
Gambit identified a second cluster of activity that it attributes to an Aurora operator with medium confidence.
- [18]
In the second cluster, eight victim organisations were targeted across Israel, Germany, Austria, Spain, the US and Argentina.
- [19]
The Gambit study was published on August 27.
- [20]
An SSH banner at /etc/ssh/sshd-banner is written with the extortion text, including a tor onion contact address and an access key, so anyone connecting over SSH sees it before the login prompt.
- [21]
8 April to 21 May 2026 inclusive is a 44-day span, which across ten target organisations averages one new environment every 4.4 days.
- [22]
Gambit published 98 days after the last Cursor Agent session it reported observing.
- [23]
Infosecurity Magazine reports the Cursor Agent sessions as running between April 8 and May 26, 2026, and describes Cursor Agent as SpaceX's AI product.
- [24]
Cursor Agent is used by software developers to complete complex coding tasks independently, run terminal commands and edit code.
Sources
4 independent publishers whose own reporting we read for this story.
- Gambit Security
gambit.security
1 article · August 27, 2026
- infosecurity-magazine.comThreat Actors Abuse Cursor Agent AI to Assist Ransomware Operations
1 article · August 28, 2026
- scworld.comAurora ransomware actors leverage AI tool for exploitation campaigns
1 article · August 28, 2026
- thehackernews.comAurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
2 articles · August 31, 2026
Topics and entities
Topics
- Ransomware
- AI-Assisted Cyberattacks
- Agentic Coding Tools
- Hypervisor and ESXi ransomware
Entities
- Aurora ransomware group
- Claude Sonnet
- CloudSEK
- VMware ESXi
- Cursor
- Anthropic
- Gambit Security