Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victims

Key facts for Aurora ransomware AI-assisted ADCS

Detection coverage for Aurora ransomware AI-assisted ADCS

As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2165 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ADCS ESC1/ESC6/ESC8 Certificate Template Abuse Correlated with NTLM Relay Coercion

Detects certificate-authority issuance events correlated with named-pipe access consistent with PetitPotam/PrinterBug/DFSCoerce coercion, the primary exploitation chain the Aurora affiliate used to mint domain-administrator certificates from misconfigured ADCS templates.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1649, T1557.001
• Data sources: windows_security_eventlog, sysmon, certificate_authority_logs
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="WinEventLog:Security" (EventCode=4886 OR EventCode=4887 OR EventCode=4870)
| eval cert_template=coalesce(Certificate_Template,CertificateTemplate)
| stats count min(_time) as first_seen max(_time) as last_seen values(Requester_Name) as requester values(cert_template) as templates values(ComputerName) as ca_server by Request_ID
| where count>1 OR match(templates,"(?i)(user|subca|webserver|machine)")
| join type=left ComputerName [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18) PipeName IN ("\\PIPE\\efsrpc","\\PIPE\\lsarpc","\\PIPE\\netdfs","\\PIPE\\spoolss") | stats count as coercion_pipe_hits by ComputerName ]
| where coercion_pipe_hits>0 OR count>2
| eval detection="ADCS certificate template abuse (ESC1/ESC6/ESC8) correlated with NTLM relay coercion (PetitPotam/PrinterBug/DFSCoerce)"

Microsoft KQL

let coercion_pipes = dynamic(["\\efsrpc","\\lsarpc","\\netdfs","\\spoolss"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "NamedPipeEvent"
| where AdditionalFields has_any (coercion_pipes)
| summarize CoercionHits=count(), Pipes=make_set(AdditionalFields) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| join kind=inner (
    SecurityEvent
    | where TimeGenerated > ago(24h)
    | where EventID in (4886, 4887, 4870)
    | summarize CertRequests=count(), Templates=make_set(CertificateTemplate) by Computer, Requester=SubjectUserName, bin(TimeGenerated, 1h)
) on $left.DeviceName == $right.Computer
| where CoercionHits > 0
| project Timestamp, DeviceName, InitiatingProcessAccountName, Pipes, CertRequests, Templates, Requester

Sigma

title: ADCS Certificate Template Abuse via NTLM Relay Coercion (ESC1/ESC6/ESC8)
id: 7f3a9c2e-1b4d-4e6f-9a2c-3d5e7f8a9b01
status: experimental
description: Detects named-pipe access consistent with PetitPotam/PrinterBug/DFSCoerce NTLM authentication coercion, used to force machine authentication to a relay that requests domain-controlling certificates via ADCS ESC1/ESC6/ESC8 misconfigured templates
references:
  - https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation
  - https://www.cloudsek.com/blog/aurora-ransomware-affiliate-ai-attack-planning-crypto-payments
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-27
tags:
  - attack.credential-access
  - attack.t1649
  - attack.t1557.001
  - attack.tool.certipy
  - attack.tool.ntlmrelayx
  - cve.2017.0144
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains:
      - '\efsrpc'
      - '\lsarpc'
      - '\netdfs'
      - '\spoolss'
  condition: selection
falsepositives:
  - Legitimate print spooler or DFS namespace traffic in environments with PrinterBug/DFSCoerce mitigations not yet applied
level: high

Known false positives:

• Legitimate print spooler or DFS namespace traffic in environments where PrinterBug/DFSCoerce mitigations are not yet applied
• Authorized ADCS template remediation work generating multiple certificate requests from the same CA

Tuning notes: Baseline legitimate EFS/print-spooler/DFS namespace pipe traffic per host before enabling alerting; scope the CA correlation to templates with client-authentication EKU or enrollee-supplied-subject flags to cut noise from routine machine-cert renewal.

• 🔒 Mass Kerberoasting / AS-REP Roasting via NetExec-style Enumeration · unlock with TL Creds
• 🔒 Multi-Browser Credential Store Access and BloodHound-style AD Enumeration · unlock with TL Creds
• 🔒 PowerShell 7-Zip Chunked Staging and [indicator]/scp Encryptor Delivery · unlock with TL Creds
• 🔒 noPac Machine Account Rename Chain and MS17-010 EternalBlue SMBv1 Exploitation · unlock with TL Creds
• 🔒 Inhibit System Recovery Chain Preceding Ransomware Encryption (Aurora) · unlock with TL Creds
• 🔒 Aurora Zig Ransomware Encryptor Execution and Ransom Note Delivery · unlock with TL Creds
• 🔒 Golden Ticket Forgery via krbtgt Abuse and noPac S4U2self · unlock with TL Creds
• 🔒 evil-winrm Lateral Movement and Chisel/Proxychains Multi-hop SOCKS Pivot to Aurora Operator Infrastructure · unlock with TL Creds

Indicators of compromise for Aurora ransomware AI-assisted ADCS

As of 2026-10-21, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-2165.

Sample indicators (3 of 31)

• IP address: 172.86.113[.]245
• URL: hxxp://ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid[.]onion
• File hash: eb0aab1e892d7e09e2c7bcf1d21fd83c1743ed9196b3efac6c78482fb0d99207

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Community OSINT corroboration for Aurora ransomware AI-assisted ADCS

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Aurora ransomware AI-assisted ADCS works

CloudSEK, in partnership with TRM Labs for on-chain payment tracing, documented a Russian-speaking Aurora ransomware affiliate operating as a direct operator (not an access broker) across a tracked three-month window (April-July 2026). The affiliate compromised 20+ organizations across 9 countries, achieving domain-level access at 17 of them and landing 4 on the public Aurora Tor leak site, with time-to-extortion ranging from 2 weeks to 2 months post-compromise. All operator infrastructure was fronted through rented SOCKS pivots on German and US VPS providers, so operator IPs never directly touched victim networks.

The affiliate's tradecraft was methodical and consistent across engagements: NetExec-driven LDAP/SMB enumeration (password policy retrieval, ASREPRoasting, Kerberoasting) followed by one of three privilege-escalation paths tailored per target -- a custom-scripted noPac chain (machine-account rename, TGT generation, S4U2self), ADCS certificate template misconfiguration abuse (ESC1, ESC6, ESC8) to mint domain-administrator certificates, or NTLM relay via coercion techniques (PetitPotam, PrinterBug, DFSCoerce). Credential harvesting extended to Kerberos ticket extraction (krbtgt captured in multiple cases), a custom seven-browser credential-theft module, and SSL-VPN credential validation. Lateral movement relied on evil-winrm, chisel, and proxychains; post-exploitation mapping used BloodHound; and in at least one case the affiliate reused the legacy EternalBlue (MS17-010) SMBv1 exploit for direct account creation. Data was staged for exfiltration via PowerShell-driven 7-Zip archiving in 50GB chunks before deployment of the encryptor, which was delivered to victim environments via a Cloudflare R2 bucket and scp.

The most novel element is the affiliate's sustained, Russian-language use of the Cursor agentic coding assistant to draft full ADCS exploitation plans, with unusually intensive iterative back-and-forth in the campaign's final weeks -- output that was written entirely in Russian rather than translated, indicating native-language use of the tool as a planning aid rather than a language-translation crutch. This mirrors a broader 2025-2026 trend of financially motivated actors weaponizing agentic coding assistants (Claude Code, Cursor) for reconnaissance, exploitation planning, and extortion workflows.

The encryptor itself is a single Zig codebase statically compiled to Windows (sap.exe), Linux, and ESXi targets -- a language choice that yields dependency-free static binaries with limited existing signature coverage. The Windows variant performs an anti-recovery chain (volume shadow copy deletion with storage resizing, System Restore disablement via registry, Hyper-V detection, backup-privilege enablement) before encryption. The Linux/ESXi variant (encrypt.out) enumerates and force-kills running VMs pre-encryption, targets VM-specific file types (vmdk, vmx, vmsd, vmsn, nvram, vmem, vswp, log), explicitly excludes ESXi system volumes, and delivers its ransom note via SSH login-banner modification rather than a dropped file. Both variants share a configurable CLI (-path, -percent<N> for partial-file encryption, -f<N><K|M|G> file-size filtering, -threads/-scanners, -extensions on Windows, -allowfolders on Linux) and embed a ransom note matching Aurora's published note character-for-character.

TRM Labs' independent on-chain analysis identified a traced wallet holding roughly 7 BTC, two confirmed and two high-moderate-confidence victim payments, and per-victim affiliate/operator revenue splits that varied widely (35/65, 21/79, 46/54, 40/60) rather than following a fixed ratio. Laundering flowed through two dominant hub-based consolidation clusters where affiliate and operator shares appear deliberately commingled before cash-out, alongside one isolated sequential peeling chain that bypassed hub consolidation entirely.

Attribution to a Russian-speaking operator is assessed with high confidence based on consistent Russian-language artifacts across all custom tooling, Cursor planning sessions, and a private GitLab repository of custom NetExec modules -- combined with a deliberate absence of CIS-allocated IP ranges or CIS-country domains in targeting across the full three-month window, corroborated by direct HUMINT engagement. Victim sectors were opportunistic rather than industry-focused, spanning manufacturing/industrial (largest share), food/agriculture/distribution, pharmaceutical/chemical, professional/financial services, transport/logistics, consumer goods, waste management, and IT/backup infrastructure, with the United States representing the largest single-country share.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.002 OS Credential Dumping; T1003.004 OS Credential Dumping; T1187 Forced Authentication; T1555.003 Credentials from Web Browsers; T1557.001 Name Resolution Poisoning and SMB Relay; T1558.001 Golden Ticket; T1558.003 Kerberoasting; T1558.004 AS-REP Roasting; T1649 Steal or Forge Authentication Certificates

Discovery

T1018 Remote System Discovery; T1069.002 Permission Groups Discovery; T1087.002 Domain Account

Lateral Movement

T1021.006 Windows Remote Management; T1210 Exploitation of Remote Services

Execution

T1059.001 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.002 Domain Accounts

Command and Control

T1090.002 Proxy; T1090.003 Multi-hop Proxy; T1572 Protocol Tunneling

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1491.001 Internal Defacement; T1657 Financial Theft

Collection

T1560.001 Archive via Utility

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.003 Acquire Infrastructure; T1588.007 Artificial Intelligence

Remediation for Aurora ransomware AI-assisted ADCS

Patches

• Apply MS17-010 (March 2017) to any remaining Windows hosts vulnerable to EternalBlue

Immediate actions

• Disable LLMNR and NBT-NS name resolution to close the NTLM relay coercion paths abused via PetitPotam, PrinterBug, and DFSCoerce
• Audit ADCS certificate templates and CA configuration for ESC1 (enrollee-supplied subject), ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2), and ESC8 (NTLM relay to web enrollment) misconfigurations
• Rotate the krbtgt account password twice, per Microsoft guidance, given confirmed krbtgt ticket extraction in multiple victim environments
• Audit Service Principal Names and rotate associated service-account credentials to blunt Kerberoasting

Workarounds

• Disable SMBv1 entirely where MS17-010 patching cannot be applied immediately
• Restrict or require HTTPS+Extended Protection for Authentication on the ADCS web enrollment (certsrv) HTTP endpoint to blunt ESC8 NTLM relay

Longer-term hardening

• Retire or isolate legacy Windows hosts still exposed to MS17-010 (EternalBlue) SMBv1 remote code execution
• Harden and air-gap/immutable-protect backup infrastructure against Inhibit System Recovery techniques (volume shadow copy deletion, System Restore disablement, backup-privilege abuse)
• Deploy browser credential-store protections (e.g., App-Bound Encryption, EDR browser-credential guards) against the affiliate's seven-browser harvesting module
• Monitor for anomalous, high-volume agentic AI coding-assistant usage patterns as a reconnaissance/planning signal

Affected and fixed versions

• Microsoft — Active Directory Certificate Services
  Vulnerable versions: environments with misconfigured ESC1/ESC6/ESC8 certificate templates or CA settings
  Fixed in: environments hardened per Microsoft ADCS security guidance
• Microsoft — Windows Server / SMBv1 (MS17-010 EternalBlue)
  Vulnerable versions: legacy, unpatched hosts with SMBv1 enabled
  Fixed in: hosts patched per MS17-010 (March 2017)
• VMware — ESXi
  Vulnerable versions: ESXi hosts reachable by the affiliate's Linux/ESXi Zig encryptor variant (encrypt.out)

Timeline of Aurora ransomware AI-assisted ADCS

Last updated 2026-10-21 · revalidated 1× · latest source

• 2026-04-01 Tracked activity window begins: a Russian-speaking locked-ioc-28 ransomware affiliate opens a three-month campaign (April-July 2026) with NetExec-driven LDAP/SMB enumeration against the first of eventually 20+ victim organizations across 9 countries, staged entirely through rented German and US VPS SOCKS pivots.
• 2026-04-08 Start of the primary locked-ioc-30 Agent-assisted exploitation window recovered from chat logs (per CSA research note).
• 2026-05-21 End of the primary locked-ioc-30 Agent-assisted exploitation window (per CSA research note).
• 2026-06-01 Across the campaign the affiliate achieves domain-level access at 17 of the 20+ compromised organizations via a repeatable playbook of Kerberoasting/ASREPRoasting, the noPac machine-account-rename chain, ADCS template abuse (ESC1/ESC6/ESC8), and NTLM relay coercion (PetitPotam/PrinterBug/DFSCoerce).
• 2026-07-01 In the final weeks of the tracked window, the affiliate's use of the locked-ioc-30 agentic coding assistant intensifies into sustained, iterative Russian-language sessions drafting and refining full ADCS exploitation plans.
• 2026-07-31 Tracked campaign activity window closes; over the period, 4 of the 20+ compromised victims are publicly listed on the locked-ioc-28 Tor leak site, with time-to-extortion ranging from 2 weeks to 2 months post-compromise.
• 2026-08-27 CloudSEK publishes "The locked-ioc-28 Files," detailing the affiliate's AI-assisted ADCS attack planning, Zig-based Windows/Linux/ESXi encryptor, and hub-based cryptocurrency laundering infrastructure.
• 2026-08-27 CloudSEK, working with TRM Labs for independent on-chain payment tracing, notifies relevant national CERTs and non-public victims ahead of public disclosure.
• 2026-09-01 Cloud Security Alliance publishes a research note on locked-ioc-28's abuse of locked-ioc-30 AI, adding operator guardrails (DCSync forbidden, no account lockouts, CIS exclusion), locked-ioc-31 exfiltration and ChaCha20/RSA-4096 encryption details.

Update history

• 2026-10-21 — locked-ioc-28 Ransomware Affiliate Uses Agentic AI (locked-ioc-30) for Attack Planning - 'Caught in 4K: The locked-ioc-28 Files': What changed No severity, exploitability or status change; existing values (HIGH / ACTIVE) already match. The update is purely additive intelligence. New indicators (4) Indicator values are withheld at this access level. New MITRE (12) 12 a

Sources cited for Aurora ransomware AI-assisted ADCS

• CVE Record: CVE-2017-0144 (EternalBlue / MS17-010) CVE Program · Advisory · 2017-03-16
• Aurora Ransomware Affiliate: AI-Assisted Attack Planning and Crypto Payment Tracing ("The Aurora Files") cloudsek.com · Vendor report · 2026-08-27
• Obtain Capabilities: Artificial Intelligence, T1588.007 MITRE · Research · 2026-08-27
• Financial Theft, T1657 MITRE · Research · 2026-08-27
• MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption Rapid7 · Vendor report · 2026-08-27
• Group: aurora ransomware.live · Research · 2026-08-27
• Certipy Wiki: Privilege Escalation (ESC1-ESC8 ADCS abuse paths) GitHub · Code repository · 2026-08-27
• Aurora Ransomware Breach Tracker galaxywarden.com · Blog · 2026-08-27
• Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations Help Net Security · News · 2025-08-28

Threats related to Aurora ransomware AI-assisted ADCS

• Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and Active Directory Environments
• Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion Operations
• AI-Enabled Ransomware and Extortion Economics: Stolen AI Credentials, Aurora Ransomware and GTG-50014 Affiliate Operations
• Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents to Reach Domain Admin and Steal Data
• Aur0ra Ransomware Operations Use Cursor and Claude AI to Automate Attacks (GOLD OGRE)

Related coverage of this activity

• Qilin ATF investigation breach
• Gentlemen ransomware worm spread
• FortiBleed brute-force credential reuse
• Gentlemen RaaS overtakes Qilin
• Safepay OneDrive exfiltration

Other reports on CVE-2017-0144

• Petya/NotPetya Outbreak (June 2017): EternalBlue/EternalRomance (MS17-010, CVE-2017-0144/0145) Lateral Movement and M.E.Doc Update Compromise
• Sality P2P Botnet Dismantled After 23 Years by CrowdStrike, FBI, DOJ, and a Europol-Led International Coalition

Previous and next in ransomware

• UNC3753 (Luna Moth / Silent Ransom Group) Vishing and Physical Intrusion Campaign Against US Law Firms Previous report