Aurora ransomware actors have been observed abusing SpaceX’s AI Cursor Agent as part of exploitation campaigns, according to a new study by Gambit Security’s Threat Intelligence team.
The threat actors ran Claude Sonnet through Cursor Agent to assist with various exploitation activities against 10 victims between April 8 and May 26, 2026.
These tasks included scanning the victim’s environment for reconnaissance purposes, installing a VPN client and running certificate attacks.
While Cursor Agent did not always achieve its stated objectives, the research demonstrated how threat actors are continuously experimenting with AI tools to speed up and enhance their campaigns.
Cursor Agent is used by software developers to complete complex coding tasks independently, run terminal commands and edit code.
How Aurora Abuses Cursor Agent in Ransomware Attacks
The Aurora operators deployed Cursor Agent to assist with post-compromise activities, providing the tool with credentials or an existing route into the victim organization.
Some of the commands given to the agent related to providing intelligence on the victim’s environment. In some cases, the attacker only asked Cursor Agent to achieve a stated objective, such as “tell me what rights the user has.”
On other occasions, specific instructions were given relating to which exploitation tool to use or to follow a previously generated attack plan. This included enumerating the domain to report which privileges a supplied user holds, using NetExec’s BloodHound collector and scanning the internal subnets for hosts with Nmap or NetExec.
Cursor Agent was also tasked with various exploitation activities, such as attempting NTLM relay attacks by coercing authentication with PetitPotam, Coerce Plus, and PrinterBug and running certificate attacks with Certipy.
The agent was also told to instal a VPN client or proxychains, then configure it and connect to a victim with supplied credentials or an existing SOCKS tunnel.
“The majority of the commands failed to achieve the stated objective on the first attempt, resulting in multiple refinements and changes to the commands and scripts used for each task. Some eventually succeeded in achieving the objective, while others failed and returned only a report of the attempts to the attacker,” the researchers wrote.
Aurora Deploys New Variant for ESXi Environments
The Gambit study, published on August 27, also observed Aurora operators deploying a new Linux ransomware variant capable of targeting ESXi environments.
The attackers used esxi_finder.py, a custom NetExec LDAP module, to scan for VMware ESXi hypervisors and vCenter servers inside a victim network.
The variant encrypts virtual machine files and skips system volumes, which keeps the hypervisor itself bootable so the victim can read the ransom demand.
Gambit researchers said they observed a second cluster of activity, that they attributed with medium confidence to an Aurora operator, in which eight victim organizations were targeted across Israel, Germany, Austria, Spain, the US and Argentina.
Aurora ransomware activity has been observed since April 2026, with the group operating a data leak site and targeting organizations across multiple countries.
Image credit: Rokas Tenys/Shutterstock.com
