# Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victims

> A Russian-speaking Aurora ransomware affiliate used the Cursor agentic coding assistant in Russian to draft and iteratively refine Active Directory Certificate Services (ADCS) exploitation plans between April and July 2026, compromising 20+ organizations across 9 countries with a repeatable playbook of AD enumeration, NTLM relay coercion, ADCS template abuse, and Kerberoasting, then deploying a Zig-based Windows/Linux/ESXi encryptor and laundering proceeds through hub-based cryptocurrency clustering infrastructure.

- **Published:** 2026-08-27T00:00:00Z
- **Last reviewed:** 2026-10-21T04:36:48.752Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2165
- **ID:** TL-2026-2165
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Aurora ransomware affiliate (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)
- **CVEs:** CVE-2017-0144

## Description

CloudSEK, in partnership with TRM Labs for on-chain payment tracing, documented a Russian-speaking Aurora ransomware affiliate operating as a direct operator (not an access broker) across a tracked three-month window (April-July 2026). The affiliate compromised 20+ organizations across 9 countries, achieving domain-level access at 17 of them and landing 4 on the public Aurora Tor leak site, with time-to-extortion ranging from 2 weeks to 2 months post-compromise. All operator infrastructure was fronted through rented SOCKS pivots on German and US VPS providers, so operator IPs never directly touched victim networks.

The affiliate's tradecraft was methodical and consistent across engagements: NetExec-driven LDAP/SMB enumeration (password policy retrieval, ASREPRoasting, Kerberoasting) followed by one of three privilege-escalation paths tailored per target -- a custom-scripted noPac chain (machine-account rename, TGT generation, S4U2self), ADCS certificate template misconfiguration abuse (ESC1, ESC6, ESC8) to mint domain-administrator certificates, or NTLM relay via coercion techniques (PetitPotam, PrinterBug, DFSCoerce). Credential harvesting extended to Kerberos ticket extraction (krbtgt captured in multiple cases), a custom seven-browser credential-theft module, and SSL-VPN credential validation. Lateral movement relied on evil-winrm, chisel, and proxychains; post-exploitation mapping used BloodHound; and in at least one case the affiliate reused the legacy EternalBlue (MS17-010) SMBv1 exploit for direct account creation. Data was staged for exfiltration via PowerShell-driven 7-Zip archiving in 50GB chunks before deployment of the encryptor, which was delivered to victim environments via a Cloudflare R2 bucket and scp.

The most novel element is the affiliate's sustained, Russian-language use of the Cursor agentic coding assistant to draft full ADCS exploitation plans, with unusually intensive iterative back-and-forth in the campaign's final weeks -- output that was written entirely in Russian rather than translated, indicating native-language use of the tool as a planning aid rather than a language-translation crutch. This mirrors a broader 2025-2026 trend of financially motivated actors weaponizing agentic coding assistants (Claude Code, Cursor) for reconnaissance, exploitation planning, and extortion workflows.

The encryptor itself is a single Zig codebase statically compiled to Windows (sap.exe), Linux, and ESXi targets -- a language choice that yields dependency-free static binaries with limited existing signature coverage. The Windows variant performs an anti-recovery chain (volume shadow copy deletion with storage resizing, System Restore disablement via registry, Hyper-V detection, backup-privilege enablement) before encryption. The Linux/ESXi variant (encrypt.out) enumerates and force-kills running VMs pre-encryption, targets VM-specific file types (vmdk, vmx, vmsd, vmsn, nvram, vmem, vswp, log), explicitly excludes ESXi system volumes, and delivers its ransom note via SSH login-banner modification rather than a dropped file. Both variants share a configurable CLI (-path, -percent<N> for partial-file encryption, -f<N><K|M|G> file-size filtering, -threads/-scanners, -extensions on Windows, -allowfolders on Linux) and embed a ransom note matching Aurora's published note character-for-character.

TRM Labs' independent on-chain analysis identified a traced wallet holding roughly 7 BTC, two confirmed and two high-moderate-confidence victim payments, and per-victim affiliate/operator revenue splits that varied widely (35/65, 21/79, 46/54, 40/60) rather than following a fixed ratio. Laundering flowed through two dominant hub-based consolidation clusters where affiliate and operator shares appear deliberately commingled before cash-out, alongside one isolated sequential peeling chain that bypassed hub consolidation entirely.

Attribution to a Russian-speaking operator is assessed with high confidence based on consistent Russian-language artifacts across all custom tooling, Cursor planning sessions, and a private GitLab repository of custom NetExec modules -- combined with a deliberate absence of CIS-allocated IP ranges or CIS-country domains in targeting across the full three-month window, corroborated by direct HUMINT engagement. Victim sectors were opportunistic rather than industry-focused, spanning manufacturing/industrial (largest share), food/agriculture/distribution, pharmaceutical/chemical, professional/financial services, transport/logistics, consumer goods, waste management, and IT/backup infrastructure, with the United States representing the largest single-country share.

## MITRE ATT&CK

- T1588.007 Artificial Intelligence
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1558.004 AS-REP Roasting
- T1558.003 Kerberoasting
- T1558.001 Golden Ticket
- T1555.003 Credentials from Web Browsers
- T1649 Steal or Forge Authentication Certificates
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1078.002 Domain Accounts
- T1021.006 Windows Remote Management
- T1090.003 Multi-hop Proxy
- T1560.001 Archive via Utility
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1491.001 Internal Defacement
- T1583.003 Acquire Infrastructure
- T1069.002 Permission Groups Discovery
- T1187 Forced Authentication
- T1003.002 OS Credential Dumping
- T1003.004 OS Credential Dumping
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1090.002 Proxy
- T1572 Protocol Tunneling
- T1059.001 Command and Scripting Interpreter
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ADCS ESC1/ESC6/ESC8 Certificate Template Abuse Correlated with NTLM Relay Coercion** (`TL-2026-2165-SPL-001`)

Detects certificate-authority issuance events correlated with named-pipe access consistent with PetitPotam/PrinterBug/DFSCoerce coercion, the primary exploitation chain the Aurora affiliate used to mint domain-administrator certificates from misconfigured ADCS templates.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1649, T1557.001
- **Data sources:** windows_security_eventlog, sysmon, certificate_authority_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="WinEventLog:Security" (EventCode=4886 OR EventCode=4887 OR EventCode=4870)
| eval cert_template=coalesce(Certificate_Template,CertificateTemplate)
| stats count min(_time) as first_seen max(_time) as last_seen values(Requester_Name) as requester values(cert_template) as templates values(ComputerName) as ca_server by Request_ID
| where count>1 OR match(templates,"(?i)(user|subca|webserver|machine)")
| join type=left ComputerName [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18) PipeName IN ("\\PIPE\\efsrpc","\\PIPE\\lsarpc","\\PIPE\\netdfs","\\PIPE\\spoolss") | stats count as coercion_pipe_hits by ComputerName ]
| where coercion_pipe_hits>0 OR count>2
| eval detection="ADCS certificate template abuse (ESC1/ESC6/ESC8) correlated with NTLM relay coercion (PetitPotam/PrinterBug/DFSCoerce)"
```

### Microsoft KQL

```kql
let coercion_pipes = dynamic(["\\efsrpc","\\lsarpc","\\netdfs","\\spoolss"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "NamedPipeEvent"
| where AdditionalFields has_any (coercion_pipes)
| summarize CoercionHits=count(), Pipes=make_set(AdditionalFields) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| join kind=inner (
    SecurityEvent
    | where TimeGenerated > ago(24h)
    | where EventID in (4886, 4887, 4870)
    | summarize CertRequests=count(), Templates=make_set(CertificateTemplate) by Computer, Requester=SubjectUserName, bin(TimeGenerated, 1h)
) on $left.DeviceName == $right.Computer
| where CoercionHits > 0
| project Timestamp, DeviceName, InitiatingProcessAccountName, Pipes, CertRequests, Templates, Requester
```

### Sigma

```yaml
title: ADCS Certificate Template Abuse via NTLM Relay Coercion (ESC1/ESC6/ESC8)
id: 7f3a9c2e-1b4d-4e6f-9a2c-3d5e7f8a9b01
status: experimental
description: Detects named-pipe access consistent with PetitPotam/PrinterBug/DFSCoerce NTLM authentication coercion, used to force machine authentication to a relay that requests domain-controlling certificates via ADCS ESC1/ESC6/ESC8 misconfigured templates
references:
  - https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation
  - https://www.cloudsek.com/blog/aurora-ransomware-affiliate-ai-attack-planning-crypto-payments
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-27
tags:
  - attack.credential-access
  - attack.t1649
  - attack.t1557.001
  - attack.tool.certipy
  - attack.tool.ntlmrelayx
  - cve.2017.0144
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains:
      - '\efsrpc'
      - '\lsarpc'
      - '\netdfs'
      - '\spoolss'
  condition: selection
falsepositives:
  - Legitimate print spooler or DFS namespace traffic in environments with PrinterBug/DFSCoerce mitigations not yet applied
level: high
```

**Known false positives:**

- Legitimate print spooler or DFS namespace traffic in environments where PrinterBug/DFSCoerce mitigations are not yet applied
- Authorized ADCS template remediation work generating multiple certificate requests from the same CA

**Tuning notes:** Baseline legitimate EFS/print-spooler/DFS namespace pipe traffic per host before enabling alerting; scope the CA correlation to templates with client-authentication EKU or enrollee-supplied-subject flags to cut noise from routine machine-cert renewal.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Mass Kerberoasting / AS-REP Roasting via NetExec-style Enumeration (locked: unlock with TL Creds)
- Multi-Browser Credential Store Access and BloodHound-style AD Enumeration (locked: unlock with TL Creds)
- PowerShell 7-Zip Chunked Staging and [indicator]/scp Encryptor Delivery (locked: unlock with TL Creds)
- noPac Machine Account Rename Chain and MS17-010 EternalBlue SMBv1 Exploitation (locked: unlock with TL Creds)
- Inhibit System Recovery Chain Preceding Ransomware Encryption (Aurora) (locked: unlock with TL Creds)
- Aurora Zig Ransomware Encryptor Execution and Ransom Note Delivery (locked: unlock with TL Creds)
- Golden Ticket Forgery via krbtgt Abuse and noPac S4U2self (locked: unlock with TL Creds)
- evil-winrm Lateral Movement and Chisel/Proxychains Multi-hop SOCKS Pivot to Aurora Operator Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `172.86.113[.]245`
- URL: `hxxp://ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid[.]onion`
- File hash: `eb0aab1e892d7e09e2c7bcf1d21fd83c1743ed9196b3efac6c78482fb0d99207`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Aurora Ransomware Affiliate: AI-Assisted Attack Planning and Crypto Payment Tracing ("The Aurora Files")](https://www.cloudsek.com/blog/aurora-ransomware-affiliate-ai-attack-planning-crypto-payments)
- [Obtain Capabilities: Artificial Intelligence, T1588.007](https://attack.mitre.org/techniques/T1588/007/)
- [Financial Theft, T1657](https://attack.mitre.org/techniques/T1657/)
- [CVE Record: CVE-2017-0144 (EternalBlue / MS17-010)](https://www.cve.org/CVERecord?id=CVE-2017-0144)
- [MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption](https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)
- [Certipy Wiki: Privilege Escalation (ESC1-ESC8 ADCS abuse paths)](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation)
- [Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations](https://www.helpnetsecurity.com/2025/08/28/agentic-ai-malicious-use/)
- [Aurora Ransomware Breach Tracker](https://www.galaxywarden.com/blog/threat/aurora)
- [Group: aurora](https://www.ransomware.live/group/aurora)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2165