# Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and Active Directory Environments

> Gambit Security documented the Aurora ("Aur0ra") ransomware group directing Cursor Agent (running the claude-4.5-sonnet-thinking model) through hands-on post-compromise exploitation — reconnaissance, NTLM authentication coercion, ADCS certificate attacks, and ESXi hypervisor discovery — across at least ten victim networks between April 8 and May 21, 2026, with a second, medium-confidence cluster of eight victims using SQL Server xp_cmdshell, GodPotato, and DCSync. Reuters and Gambit publicly disclosed the campaign on August 27, 2026, based on exposed Aurora operator infrastructure.

- **Published:** 2026-08-30T00:00:00Z
- **Last reviewed:** 2026-08-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2243
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-aurora-cursor-agent-ransomware-tl-2026-2243.webp?v=ca135168 (Threadlinqs threat intel: Aurora Ransomware Leverages Cursor AI: Detection & IOCs (TL-2026-2243) — High severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-2243
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Aurora
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Gambit Security's threat intelligence team (director Eyal Sela) recovered roughly six weeks of operator session logs from exposed infrastructure belonging to the Aurora ransomware group (also referred to as "Aur0ra"), a Russian-speaking, financially motivated ransomware gang that has operated a data leak site since approximately April 2026. The logs show a human operator driving SpaceX's Cursor Agent AI coding tool — running the model identifier "claude-4.5-sonnet-thinking" — as a hands-on exploitation aide inside at least ten victim networks between April 8 and May 21, 2026. The operator supplied the agent with credentials or existing network access and issued natural-language tasking that the agent translated into terminal commands: environmental reconnaissance, VPN client and proxychains/SOCKS tunnel configuration, subnet scanning with Nmap and NetExec, domain privilege enumeration via NetExec's BloodHound collector, NTLM authentication-coercion attacks (PetitPotam, Coerce Plus, PrinterBug) relayed with Impacket's ntlmrelayx, Active Directory Certificate Services abuse via Certipy, SYSTEM privilege escalation with GodPotato, and hypervisor discovery through a custom NetExec LDAP module named esxi_finder.py that scans for ESXi management ports (443, 902). Gambit characterized the interaction as resembling "a junior intruder working a shift with a senior engineer on call": most agent-issued commands failed on the first attempt and required iterative refinement rather than one-shot success, and the operator repeatedly imposed three operational-security restrictions on the agent, given in Russian across victims — no DCSync operations, no account lockouts during password spraying, and no new domain computer objects.

Confirmed victims of the first cluster include Christeyns (a Belgian cleaning-products manufacturer), Teckentrup (a German garage-door manufacturer), Helideck Certification Agency (Scotland-based), a Louisiana title-insurance firm, and an Argentine pharmaceutical distributor; Reuters confirmed at least seven breached organizations overall. Gambit separately identified, at medium confidence, a second Aurora-attributed cluster of eight victims across Israel, Germany, Austria, Spain, the United States, and Argentina, in which a different operator moved laterally via an exposed SQL Server's xp_cmdshell, escalated to SYSTEM with GodPotato, ran DCSync against the domain controller (violating the first cluster's own no-DCSync rule), and exfiltrated data with the s5cmd utility to a self-hosted S3-compatible storage endpoint.

The ransomware payload itself is a new Linux ELF binary (encrypt.out, ~139KB) purpose-built to target VMware ESXi hosts: it enumerates running virtual machines with esxcli vm process list, force-kills them with esxcli vm process kill --type=force, and encrypts VM-related files (.vmdk, .vmx, .vmsd, .vmsn, .nvram, .vmem, .vswp, and log files) using ChaCha20 for bulk encryption with RSA-4096 key wrapping, while deliberately preserving the BOOTBANK* and OSDATA* system volumes so the hypervisor itself remains bootable. Rather than dropping a conventional ransom-note file, Aurora overwrites /etc/ssh/sshd-banner so the ransom note (referencing a file named !!!README!!!DO_NOT_DELETE.txt) is displayed to anyone who opens an SSH session to the compromised hypervisor. Exfiltrated data from the first cluster was staged via a Cloudflare R2 bucket and threatened via both a Tor-hosted leak portal and a clearnet leak site (exposedrecords.io); the group's operators communicate and document their internal rules in Russian, but neither Gambit nor Reuters attributes the campaign to a specific nation-state — the descriptor used throughout reporting is "Russian-speaking," not state-sponsored. Neither Cursor nor SpaceX commented on the findings, and Gambit explicitly stated its research does not allege any failure in Cursor's own systems; the significance is that a widely available agentic coding tool functioned as an on-demand exploitation consultant that lowered the skill floor for hands-on network intrusion, not that it produced novel malware or exploits on its own.

## MITRE ATT&CK

- T1583.006 Acquire Infrastructure: Web Services
- T1608.001 Stage Capabilities: Upload Malware
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1187 Forced Authentication
- T1649 Steal or Forge Authentication Certificates
- T1110.003 Brute Force: Password Spraying
- T1557 Adversary-in-the-Middle
- T1003.006 OS Credential Dumping: DCSync
- T1046 Network Service Discovery
- T1087.002 Account Discovery: Domain Account
- T1018 Remote System Discovery
- T1090.003 Proxy: Multi-hop Proxy
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1489 Service Stop
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Aurora NTLM Coercion (PetitPotam/PrinterBug/Coerce Plus) Relayed to Known Operator Infrastructure** (`TL-2026-2243-SPL-001`)

Detects the forced-authentication coercion pipes (EFSRPC/PetitPotam, SPOOLSS/PrinterBug, NETDFS-DFSR/Coerce Plus, LSARPC) that Aurora operators drove Cursor Agent to issue, correlated with successful network logons originating from Aurora's documented C2 and SOCKS/proxychains egress IPs. Coercion forces a domain-joined machine account to authenticate to an attacker-controlled listener so Impacket ntlmrelayx can relay the NTLM handshake into ADCS or LDAP.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1187, T1557, T1078
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
`comment("Aurora T1187/T1557 -- coercion pipe access correlated with NTLM logon from known Aurora infrastructure")`
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18)
| rex field=PipeName "(?i)(?<coerce_pipe>\\\\PIPE\\\\(EFSRPC|LSARPC|SPOOLSS|NETDFS|DFSR))"
| where isnotnull(coerce_pipe)
| eval coercion_technique=case(match(coerce_pipe,"(?i)EFSRPC"),"PetitPotam",match(coerce_pipe,"(?i)SPOOLSS"),"PrinterBug",match(coerce_pipe,"(?i)(NETDFS|DFSR)"),"Coerce Plus",match(coerce_pipe,"(?i)LSARPC"),"PetitPotam-LSARPC",1=1,"Unknown-Coercion-Pipe")
| append
    [ search index=windows_security sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
      | eval src_ip=coalesce(Source_Network_Address, src_ip)
      | search src_ip IN ("172.86.113.245","172.86.90.75","146.19.125.36","89.106.83.49","104.194.134.167","68.210.224.231","45.61.148.166","167.88.167.37")
      | eval coercion_technique="NTLM-Relay-Auth-From-Aurora-Infra" ]
| stats count min(_time) as first_seen max(_time) as last_seen values(coercion_technique) as techniques values(coerce_pipe) as pipes_observed dc(coercion_technique) as technique_diversity by Computer, src_ip, Account_Name
| where count >= 1
| sort -count
```

### Microsoft KQL

```kql
let aurora_ips = dynamic(["172.86.113.245","172.86.90.75","146.19.125.36","89.106.83.49","104.194.134.167","68.210.224.231","45.61.148.166","167.88.167.37"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "NamedPipeEvent"
| where AdditionalFields has_any ("EFSRPC","LSARPC","SPOOLSS","NETDFS","DFSR")
| extend CoercionTechnique = case(AdditionalFields has "EFSRPC", "PetitPotam", AdditionalFields has "SPOOLSS", "PrinterBug", AdditionalFields has_any ("NETDFS","DFSR"), "Coerce Plus", "PetitPotam-LSARPC")
| project Timestamp, DeviceName, InitiatingProcessAccountName, CoercionTechnique
| join kind=inner (
    DeviceLogonEvents
    | where Timestamp > ago(24h)
    | where RemoteIP in (aurora_ips)
    | project Timestamp, DeviceName, RemoteIP, AccountName
) on DeviceName
| project Timestamp, DeviceName, AccountName, RemoteIP, CoercionTechnique, InitiatingProcessAccountName
| sort by Timestamp desc
```

### Sigma

```yaml
title: NTLM Coercion Pipe Access Followed by Auth From Aurora Ransomware Infrastructure
id: e1a4c7d2-9f36-4a51-8f0d-3b8f7c92c1a1
status: experimental
description: Detects named-pipe access consistent with PetitPotam, PrinterBug, or Coerce Plus forced-authentication coercion, used by Aurora ransomware operators via Cursor Agent to relay NTLM auth with Impacket ntlmrelayx.
references:
    - https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.credential-access
    - attack.t1187
    - attack.t1557
    - attack.t1078
    - attack.tool.impacket_ntlmrelayx
    - attack.actor.aurora
logsource:
    category: pipe_created
    product: windows
detection:
    selection_pipe:
        PipeName|contains:
            - '\EFSRPC'
            - '\LSARPC'
            - '\SPOOLSS'
            - '\NETDFS'
            - '\DFSR'
    filter_print_service_normal:
        Image|endswith: '\spoolsv.exe'
        PipeName|contains: '\SPOOLSS'
    condition: selection_pipe and not filter_print_service_normal
falsepositives:
    - Legitimate EFS/DFS-R replication or print spooler activity between trusted file/print servers
    - Vulnerability scanners intentionally testing for PetitPotam/PrinterBug exposure
level: high
```

**Known false positives:**

- Legitimate DFS-R replication or Print Spooler traffic between trusted file/print servers can access the same named pipes
- Authorized penetration testing or ADCS/coercion vulnerability scanning

**Tuning notes:** Scope the src_ip/RemoteIP allowlist to your environment's known relay/jump hosts before deploying broadly, and add new Aurora C2/proxy IPs from future Gambit/Reuters updates to the lookup list; exclude the print server's own PID chain to remove routine SPOOLSS false positives.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Proxychains/SOCKS Tunneling and Nmap/NetExec Subnet Reconnaissance to Aurora Infrastructure (locked: unlock with TL Creds)
- Lockout-Evading Password Spraying Correlated With BloodHound-Style Domain Enumeration (locked: unlock with TL Creds)
- Data Exfiltration via s5cmd to Aurora Self-Hosted S3 Infrastructure and Extortion-Portal Communication (locked: unlock with TL Creds)
- SQL Server xp_cmdshell Re-Enablement and Shell Spawn (Second-Cluster Initial Foothold) (locked: unlock with TL Creds)
- AI Coding Agent (Cursor Agent) Spawning Offensive Security Tooling (locked: unlock with TL Creds)
- Aurora ELF Ransomware Execution on ESXi (ChaCha20/RSA-4096 Encryptor Binary Indicators) (locked: unlock with TL Creds)
- ADCS Certificate Abuse (Certipy), GodPotato Token Impersonation, and DCSync Replication Chain (locked: unlock with TL Creds)
- ESXi Hypervisor Discovery (esxi_finder.py), Forced VM Shutdown, and SSH Banner Ransom Note Overwrite (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `172.86.113[.]245`
- Domain: `ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid[.]onion`
- URL: `hxxps://pub-c057b7d0b24944a29e381ce9ea22a2f1[.]r2[.]dev/xu4gid0t8er3.out`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations](https://www.infosecurity-magazine.com/news/abuse-cursor-agent-ransomware/)
- [Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation](https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation)
- [Ransomware Operator Ran Cursor Agent Inside Ten Victim Networks](https://oodaloop.com/briefs/cyber/ransomware-operator-ran-cursor-agent-inside-ten-victim-networks/)
- [Russian Hackers Used SpaceX's AI Coding Assistant To Conduct Attacks: Report](https://www.ibtimes.com/russian-hackers-used-spacexs-ai-coding-assistant-conduct-attacks-report-3806860)
- [Ransomware Operator Ran Cursor Agent Inside Ten Victim Networks](https://www.unite.ai/ransomware-operator-ran-cursor-agent-inside-ten-victim-networks/)
- [Ransomware Crew Used Cursor's AI Agent to Attack Company Networks](https://beingguru.com/ransomware-crew-used-cursors-ai-agent-to-attack-company-networks/)
- [Aurora ransomware actors leverage AI tool for exploitation campaigns](https://www.scworld.com/brief/aurora-ransomware-actors-leverage-ai-tool-for-exploitation-campaigns)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2243