# Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victims

> A Russian-speaking Aurora ransomware affiliate used the Cursor agentic coding assistant in Russian to draft and iteratively refine Active Directory Certificate Services (ADCS) exploitation plans between April and July 2026, compromising 20+ organizations across 9 countries with a repeatable playbook of AD enumeration, NTLM relay coercion, ADCS template abuse, and Kerberoasting, then deploying a Zig-based Windows/Linux/ESXi encryptor and laundering proceeds through hub-based cryptocurrency clustering infrastructure.

- **Published:** 2026-08-27T00:00:00Z
- **Last reviewed:** 2026-08-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2165
- **ID:** TL-2026-2165
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Aurora ransomware affiliate (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-0144

## Description

CloudSEK, in partnership with TRM Labs for on-chain payment tracing, documented a Russian-speaking Aurora ransomware affiliate operating as a direct operator (not an access broker) across a tracked three-month window (April-July 2026). The affiliate compromised 20+ organizations across 9 countries, achieving domain-level access at 17 of them and landing 4 on the public Aurora Tor leak site, with time-to-extortion ranging from 2 weeks to 2 months post-compromise. All operator infrastructure was fronted through rented SOCKS pivots on German and US VPS providers, so operator IPs never directly touched victim networks.

The affiliate's tradecraft was methodical and consistent across engagements: NetExec-driven LDAP/SMB enumeration (password policy retrieval, ASREPRoasting, Kerberoasting) followed by one of three privilege-escalation paths tailored per target -- a custom-scripted noPac chain (machine-account rename, TGT generation, S4U2self), ADCS certificate template misconfiguration abuse (ESC1, ESC6, ESC8) to mint domain-administrator certificates, or NTLM relay via coercion techniques (PetitPotam, PrinterBug, DFSCoerce). Credential harvesting extended to Kerberos ticket extraction (krbtgt captured in multiple cases), a custom seven-browser credential-theft module, and SSL-VPN credential validation. Lateral movement relied on evil-winrm, chisel, and proxychains; post-exploitation mapping used BloodHound; and in at least one case the affiliate reused the legacy EternalBlue (MS17-010) SMBv1 exploit for direct account creation. Data was staged for exfiltration via PowerShell-driven 7-Zip archiving in 50GB chunks before deployment of the encryptor, which was delivered to victim environments via a Cloudflare R2 bucket and scp.

The most novel element is the affiliate's sustained, Russian-language use of the Cursor agentic coding assistant to draft full ADCS exploitation plans, with unusually intensive iterative back-and-forth in the campaign's final weeks -- output that was written entirely in Russian rather than translated, indicating native-language use of the tool as a planning aid rather than a language-translation crutch. This mirrors a broader 2025-2026 trend of financially motivated actors weaponizing agentic coding assistants (Claude Code, Cursor) for reconnaissance, exploitation planning, and extortion workflows.

The encryptor itself is a single Zig codebase statically compiled to Windows (sap.exe), Linux, and ESXi targets -- a language choice that yields dependency-free static binaries with limited existing signature coverage. The Windows variant performs an anti-recovery chain (volume shadow copy deletion with storage resizing, System Restore disablement via registry, Hyper-V detection, backup-privilege enablement) before encryption. The Linux/ESXi variant (encrypt.out) enumerates and force-kills running VMs pre-encryption, targets VM-specific file types (vmdk, vmx, vmsd, vmsn, nvram, vmem, vswp, log), explicitly excludes ESXi system volumes, and delivers its ransom note via SSH login-banner modification rather than a dropped file. Both variants share a configurable CLI (-path, -percent<N> for partial-file encryption, -f<N><K|M|G> file-size filtering, -threads/-scanners, -extensions on Windows, -allowfolders on Linux) and embed a ransom note matching Aurora's published note character-for-character.

TRM Labs' independent on-chain analysis identified a traced wallet holding roughly 7 BTC, two confirmed and two high-moderate-confidence victim payments, and per-victim affiliate/operator revenue splits that varied widely (35/65, 21/79, 46/54, 40/60) rather than following a fixed ratio. Laundering flowed through two dominant hub-based consolidation clusters where affiliate and operator shares appear deliberately commingled before cash-out, alongside one isolated sequential peeling chain that bypassed hub consolidation entirely.

Attribution to a Russian-speaking operator is assessed with high confidence based on consistent Russian-language artifacts across all custom tooling, Cursor planning sessions, and a private GitLab repository of custom NetExec modules -- combined with a deliberate absence of CIS-allocated IP ranges or CIS-country domains in targeting across the full three-month window, corroborated by direct HUMINT engagement. Victim sectors were opportunistic rather than industry-focused, spanning manufacturing/industrial (largest share), food/agriculture/distribution, pharmaceutical/chemical, professional/financial services, transport/logistics, consumer goods, waste management, and IT/backup infrastructure, with the United States representing the largest single-country share.

## MITRE ATT&CK

- T1588.007 Artificial Intelligence
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1558.004 AS-REP Roasting
- T1558.003 Kerberoasting
- T1558.001 Golden Ticket
- T1555.003 Credentials from Web Browsers
- T1649 Steal or Forge Authentication Certificates
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1078.002 Domain Accounts
- T1021.006 Windows Remote Management
- T1090.003 Multi-hop Proxy
- T1560.001 Archive via Utility
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1491.001 Internal Defacement

## Sources

- [Aurora Ransomware Affiliate: AI-Assisted Attack Planning and Crypto Payment Tracing ("The Aurora Files")](https://www.cloudsek.com/blog/aurora-ransomware-affiliate-ai-attack-planning-crypto-payments)
- [Obtain Capabilities: Artificial Intelligence, T1588.007](https://attack.mitre.org/techniques/T1588/007/)
- [Financial Theft, T1657](https://attack.mitre.org/techniques/T1657/)
- [CVE Record: CVE-2017-0144 (EternalBlue / MS17-010)](https://www.cve.org/CVERecord?id=CVE-2017-0144)
- [MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption](https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)
- [Certipy Wiki: Privilege Escalation (ESC1-ESC8 ADCS abuse paths)](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation)
- [Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations](https://www.helpnetsecurity.com/2025/08/28/agentic-ai-malicious-use/)
- [Aurora Ransomware Breach Tracker](https://www.galaxywarden.com/blog/threat/aurora)
- [Group: aurora](https://www.ransomware.live/group/aurora)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2165