Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and Active Directory Environments

Key facts for Aurora Cursor Agent ransomware

Detection coverage for Aurora Cursor Agent ransomware

As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2243 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Aurora NTLM Coercion (PetitPotam/PrinterBug/Coerce Plus) Relayed to Known Operator Infrastructure

Detects the forced-authentication coercion pipes (EFSRPC/PetitPotam, SPOOLSS/PrinterBug, NETDFS-DFSR/Coerce Plus, LSARPC) that Aurora operators drove Cursor Agent to issue, correlated with successful network logons originating from Aurora's documented C2 and SOCKS/proxychains egress IPs. Coercion forces a domain-joined machine account to authenticate to an attacker-controlled listener so Impacket ntlmrelayx can relay the NTLM handshake into ADCS or LDAP.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1187, T1557, T1078
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

`comment("Aurora T1187/T1557 -- coercion pipe access correlated with NTLM logon from known Aurora infrastructure")`
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18)
| rex field=PipeName "(?i)(?<coerce_pipe>\\\\PIPE\\\\(EFSRPC|LSARPC|SPOOLSS|NETDFS|DFSR))"
| where isnotnull(coerce_pipe)
| eval coercion_technique=case(match(coerce_pipe,"(?i)EFSRPC"),"PetitPotam",match(coerce_pipe,"(?i)SPOOLSS"),"PrinterBug",match(coerce_pipe,"(?i)(NETDFS|DFSR)"),"Coerce Plus",match(coerce_pipe,"(?i)LSARPC"),"PetitPotam-LSARPC",1=1,"Unknown-Coercion-Pipe")
| append
    [ search index=windows_security sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
      | eval src_ip=coalesce(Source_Network_Address, src_ip)
      | search src_ip IN ("172.86.113.245","172.86.90.75","146.19.125.36","89.106.83.49","104.194.134.167","68.210.224.231","45.61.148.166","167.88.167.37")
      | eval coercion_technique="NTLM-Relay-Auth-From-Aurora-Infra" ]
| stats count min(_time) as first_seen max(_time) as last_seen values(coercion_technique) as techniques values(coerce_pipe) as pipes_observed dc(coercion_technique) as technique_diversity by Computer, src_ip, Account_Name
| where count >= 1
| sort -count

Microsoft KQL

let aurora_ips = dynamic(["172.86.113.245","172.86.90.75","146.19.125.36","89.106.83.49","104.194.134.167","68.210.224.231","45.61.148.166","167.88.167.37"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "NamedPipeEvent"
| where AdditionalFields has_any ("EFSRPC","LSARPC","SPOOLSS","NETDFS","DFSR")
| extend CoercionTechnique = case(AdditionalFields has "EFSRPC", "PetitPotam", AdditionalFields has "SPOOLSS", "PrinterBug", AdditionalFields has_any ("NETDFS","DFSR"), "Coerce Plus", "PetitPotam-LSARPC")
| project Timestamp, DeviceName, InitiatingProcessAccountName, CoercionTechnique
| join kind=inner (
    DeviceLogonEvents
    | where Timestamp > ago(24h)
    | where RemoteIP in (aurora_ips)
    | project Timestamp, DeviceName, RemoteIP, AccountName
) on DeviceName
| project Timestamp, DeviceName, AccountName, RemoteIP, CoercionTechnique, InitiatingProcessAccountName
| sort by Timestamp desc

Sigma

title: NTLM Coercion Pipe Access Followed by Auth From Aurora Ransomware Infrastructure
id: e1a4c7d2-9f36-4a51-8f0d-3b8f7c92c1a1
status: experimental
description: Detects named-pipe access consistent with PetitPotam, PrinterBug, or Coerce Plus forced-authentication coercion, used by Aurora ransomware operators via Cursor Agent to relay NTLM auth with Impacket ntlmrelayx.
references:
    - https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.credential-access
    - attack.t1187
    - attack.t1557
    - attack.t1078
    - attack.tool.impacket_ntlmrelayx
    - attack.actor.aurora
logsource:
    category: pipe_created
    product: windows
detection:
    selection_pipe:
        PipeName|contains:
            - '\EFSRPC'
            - '\LSARPC'
            - '\SPOOLSS'
            - '\NETDFS'
            - '\DFSR'
    filter_print_service_normal:
        Image|endswith: '\spoolsv.exe'
        PipeName|contains: '\SPOOLSS'
    condition: selection_pipe and not filter_print_service_normal
falsepositives:
    - Legitimate EFS/DFS-R replication or print spooler activity between trusted file/print servers
    - Vulnerability scanners intentionally testing for PetitPotam/PrinterBug exposure
level: high

Known false positives:

• Legitimate DFS-R replication or Print Spooler traffic between trusted file/print servers can access the same named pipes
• Authorized penetration testing or ADCS/coercion vulnerability scanning

Tuning notes: Scope the src_ip/RemoteIP allowlist to your environment's known relay/jump hosts before deploying broadly, and add new Aurora C2/proxy IPs from future Gambit/Reuters updates to the lookup list; exclude the print server's own PID chain to remove routine SPOOLSS false positives.

• 🔒 Proxychains/SOCKS Tunneling and Nmap/NetExec Subnet Reconnaissance to Aurora Infrastructure · unlock with TL Creds
• 🔒 Lockout-Evading Password Spraying Correlated With BloodHound-Style Domain Enumeration · unlock with TL Creds
• 🔒 Data Exfiltration via s5cmd to Aurora Self-Hosted S3 Infrastructure and Extortion-Portal Communication · unlock with TL Creds
• 🔒 SQL Server xp_cmdshell Re-Enablement and Shell Spawn (Second-Cluster Initial Foothold) · unlock with TL Creds
• 🔒 AI Coding Agent (Cursor Agent) Spawning Offensive Security Tooling · unlock with TL Creds
• 🔒 Aurora ELF Ransomware Execution on ESXi (ChaCha20/RSA-4096 Encryptor Binary Indicators) · unlock with TL Creds
• 🔒 ADCS Certificate Abuse (Certipy), GodPotato Token Impersonation, and DCSync Replication Chain · unlock with TL Creds
• 🔒 ESXi Hypervisor Discovery (esxi_finder.py), Forced VM Shutdown, and SSH Banner Ransom Note Overwrite · unlock with TL Creds

Indicators of compromise for Aurora Cursor Agent ransomware

As of 2026-08-30, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2243.

Sample indicators (3 of 29)

• IP address: 172.86.113[.]245
• Domain: ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid[.]onion
• URL: hxxps://pub-c057b7d0b24944a29e381ce9ea22a2f1[.]r2[.]dev/xu4gid0t8er3.out

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration for Aurora Cursor Agent ransomware

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Aurora Cursor Agent ransomware works

Reuters and Gambit publicly disclosed the campaign on August 27, 2026, based on exposed Aurora operator infrastructure.

Gambit Security's threat intelligence team (director Eyal Sela) recovered roughly six weeks of operator session logs from exposed infrastructure belonging to the Aurora ransomware group (also referred to as "Aur0ra"), a Russian-speaking, financially motivated ransomware gang that has operated a data leak site since approximately April 2026. The logs show a human operator driving SpaceX's Cursor Agent AI coding tool — running the model identifier "claude-4.5-sonnet-thinking" — as a hands-on exploitation aide inside at least ten victim networks between April 8 and May 21, 2026. The operator supplied the agent with credentials or existing network access and issued natural-language tasking that the agent translated into terminal commands: environmental reconnaissance, VPN client and proxychains/SOCKS tunnel configuration, subnet scanning with Nmap and NetExec, domain privilege enumeration via NetExec's BloodHound collector, NTLM authentication-coercion attacks (PetitPotam, Coerce Plus, PrinterBug) relayed with Impacket's ntlmrelayx, Active Directory Certificate Services abuse via Certipy, SYSTEM privilege escalation with GodPotato, and hypervisor discovery through a custom NetExec LDAP module named esxi_finder.py that scans for ESXi management ports (443, 902). Gambit characterized the interaction as resembling "a junior intruder working a shift with a senior engineer on call": most agent-issued commands failed on the first attempt and required iterative refinement rather than one-shot success, and the operator repeatedly imposed three operational-security restrictions on the agent, given in Russian across victims — no DCSync operations, no account lockouts during password spraying, and no new domain computer objects.

Confirmed victims of the first cluster include Christeyns (a Belgian cleaning-products manufacturer), Teckentrup (a German garage-door manufacturer), Helideck Certification Agency (Scotland-based), a Louisiana title-insurance firm, and an Argentine pharmaceutical distributor; Reuters confirmed at least seven breached organizations overall. Gambit separately identified, at medium confidence, a second Aurora-attributed cluster of eight victims across Israel, Germany, Austria, Spain, the United States, and Argentina, in which a different operator moved laterally via an exposed SQL Server's xp_cmdshell, escalated to SYSTEM with GodPotato, ran DCSync against the domain controller (violating the first cluster's own no-DCSync rule), and exfiltrated data with the s5cmd utility to a self-hosted S3-compatible storage endpoint.

The ransomware payload itself is a new Linux ELF binary (encrypt.out, ~139KB) purpose-built to target VMware ESXi hosts: it enumerates running virtual machines with esxcli vm process list, force-kills them with esxcli vm process kill --type=force, and encrypts VM-related files (.vmdk, .vmx, .vmsd, .vmsn, .nvram, .vmem, .vswp, and log files) using ChaCha20 for bulk encryption with RSA-4096 key wrapping, while deliberately preserving the BOOTBANK* and OSDATA* system volumes so the hypervisor itself remains bootable. Rather than dropping a conventional ransom-note file, Aurora overwrites /etc/ssh/sshd-banner so the ransom note (referencing a file named !!!README!!!DO_NOT_DELETE.txt) is displayed to anyone who opens an SSH session to the compromised hypervisor. Exfiltrated data from the first cluster was staged via a Cloudflare R2 bucket and threatened via both a Tor-hosted leak portal and a clearnet leak site (exposedrecords.io); the group's operators communicate and document their internal rules in Russian, but neither Gambit nor Reuters attributes the campaign to a specific nation-state — the descriptor used throughout reporting is "Russian-speaking," not state-sponsored. Neither Cursor nor SpaceX commented on the findings, and Gambit explicitly stated its research does not allege any failure in Cursor's own systems; the significance is that a widely available agentic coding tool functioned as an on-demand exploitation consultant that lowered the skill floor for hands-on network intrusion, not that it produced novel malware or exploits on its own.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 OS Credential Dumping: DCSync; T1110.003 Brute Force: Password Spraying; T1187 Forced Authentication; T1557 Adversary-in-the-Middle; T1649 Steal or Forge Authentication Certificates

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1087.002 Account Discovery: Domain Account

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts

Command and Control

T1090.003 Proxy: Multi-hop Proxy

Privilege Escalation

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Impact

T1489 Service Stop; T1657 Financial Theft

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Resource Development

T1583.006 Acquire Infrastructure: Web Services; T1608.001 Stage Capabilities: Upload Malware

Remediation for Aurora Cursor Agent ransomware

Patches

• No CVE is associated with this campaign; mitigation is configuration-based (disable NTLM where feasible, enforce Kerberos-only authentication, harden AD CS enrollment endpoints) rather than a vendor patch.

Immediate actions

• Disable or restrict the EFS-RPC (PetitPotam), Print Spooler (PrinterBug), and DFS-R (Coerce Plus) coercion vectors; enforce SMB signing and Extended Protection for Authentication (EPA) on all domain controllers and AD CS endpoints.
• Audit Active Directory Certificate Services (ADCS) enrollment templates for ESC-style misconfigurations and monitor for Certipy tool signatures (characteristic LDAP/RPC queries against the CA).
• Restrict and alert on outbound proxychains/SOCKS traffic and unapproved VPN client installation from servers and privileged workstations.
• Alert on `esxcli vm process kill`/`list` invoked from non-management hosts and on LDAP queries enumerating hosts on ESXi management ports 443/902 (esxi_finder-style discovery).
• Enable smart-lockout / impossible-travel style detection for password spraying that does not rely solely on hard account lockout thresholds.

Workarounds

• Apply Microsoft's PetitPotam mitigation guidance (disable the EFS-RPC named pipe / KB5005413) where NTLM cannot be fully disabled.
• Disable the Print Spooler service on domain controllers and servers that do not require it.
• Disable or tightly restrict xp_cmdshell on SQL Server instances that do not require it.

Longer-term hardening

• Segment ESXi/vCenter management interfaces from general Active Directory-joined networks and require jump hosts for hypervisor administration.
• Maintain immutable, offline/air-gapped VM backups so hosts that had their VMs killed and encrypted can be restored without paying ransom.
• Establish an audit/logging policy for AI coding-agent tools (Cursor Agent and similar) that grant terminal or system access, including command-level transcripts, and prohibit their use on production or privileged infrastructure.
• Deploy EDR/XDR with detections for DCSync, NTLM relay (ntlmrelayx), and Potato-family token-impersonation privilege escalation across both the Windows and Linux/ESXi estate.
• Disable SQL Server xp_cmdshell by default across the estate and alert on its re-enablement.

Affected and fixed versions

• Broadcom (VMware) — ESXi
  Vulnerable versions: Not a software vulnerability — hypervisors are targeted via valid administrative credentials/network access and a custom Linux ransomware binary, not a CVE
• Microsoft — Active Directory / Windows Server (NTLM, AD CS, SQL Server)
  Vulnerable versions: Protocol/configuration-level abuse (NTLM coercion via PetitPotam/Coerce Plus/PrinterBug, AD CS certificate abuse, SQL Server xp_cmdshell) rather than a specific CVE

Timeline of Aurora Cursor Agent ransomware

• 2026-04-01 Aurora ransomware group (aka Aur0ra) reported active, operating a Tor-hosted leak portal and a clearnet leak site (locked-ioc-9).
• 2026-04-08 An Aurora operator begins directing locked-ioc-24 (running claude-4.5-sonnet-thinking) through post-compromise exploitation across the first cluster of ten victim networks, including locked-ioc-25 (Belgium), Teckentrup (Germany), Helideck Certification Agency (Scotland), a Louisiana title-insurance firm, and an Argentine pharmaceutical distributor.
• 2026-05-21 Documented first-cluster Cursor Agent-assisted intrusion activity concludes; Gambit Security later recovers roughly six weeks of operator session logs covering this period.
• 2026-08-27 Gambit discloses a second, medium-confidence Aurora-attributed cluster of eight victims across Israel, Germany, Austria, Spain, the United States, and Argentina, involving a different operator using SQL Server xp_cmdshell, locked-ioc-26, DCSync, and locked-ioc-29 exfiltration to self-hosted S3-compatible storage.
• 2026-08-27 Reuters and Gambit Security (director of threat intelligence Eyal Sela) publicly disclose the campaign based on exposed Aurora operator infrastructure, confirming at least seven breached companies.
• 2026-08-28 Infosecurity Magazine and other outlets (OODAloop, IBTimes, Unite.AI, SC World) publish follow-on coverage of the Gambit Security findings.

Sources cited for Aurora Cursor Agent ransomware

• Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation gambit.security · Vendor report · 2026-08-27
• Ransomware Crew Used Cursor's AI Agent to Attack Company Networks beingguru.com · Blog · 2026-08-27
• Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations infosecurity-magazine.com · News · 2026-08-28
• Ransomware Operator Ran Cursor Agent Inside Ten Victim Networks oodaloop.com · News · 2026-08-27
• Russian Hackers Used SpaceX's AI Coding Assistant To Conduct Attacks: Report ibtimes.com · News · 2026-08-27
• Ransomware Operator Ran Cursor Agent Inside Ten Victim Networks unite.ai · News · 2026-08-27
• Aurora ransomware actors leverage AI tool for exploitation campaigns scworld.com · News · 2026-08-27

Threats related to Aurora Cursor Agent ransomware

• Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victims
• Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion Operations
• AI-Enabled Ransomware and Extortion Economics: Stolen AI Credentials, Aurora Ransomware and GTG-50014 Affiliate Operations
• Aur0ra Ransomware Operators (GOLD OGRE) Use Cursor AI Agents to Reach Domain Admin and Steal Data
• Aur0ra Ransomware Operations Use Cursor and Claude AI to Automate Attacks (GOLD OGRE)

Related coverage of this activity

• Akira msconfig Safe Mode reboot
• VECT 2.0 accidental wiper
• AnMed health system ransomware

Previous and next in ransomware

• Emperador ransomware group claims breach of Uniguaçu (Brazilian education sector) Previous report
• The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR Killers, and Rclone Exfiltration Next report