Aurora ransomware used Cursor AI as an intrusion tool
What researchers found
Between April and May 2026, a threat actor operating as an Aurora ransomware affiliate used Cursor, an agentic AI coding assistant, to conduct hands-on intrusion work against at least 10 victims across 20+ organizations in nine countries.
Gambit Security and The Hacker News published joint coverage in late August 2026. The finding is significant because Cursor is a commercial product used by hundreds of thousands of software developers, and its operator used it not to write malware but as a live intrusion operations center.
How the attacker used the AI
The affiliate issued instructions in Russian through Cursor's interface. Tasks included reconnaissance, credential theft, and Kerberos and Active Directory escalation.
What makes this case technically notable is the OPSEC discipline the attacker built into the AI prompt itself. They explicitly forbade noisy techniques like DCSync attacks, instructed the model to avoid triggering account lockouts, and encoded a rule to exclude CIS country ranges and domains from all targeting activity.
This is not a case of someone accidentally stumbling into using AI for attacks. The attacker understood the model's capabilities well enough to constrain them in operationally meaningful ways.
Why Cursor specifically
Cursor's agentic mode, unlike a direct API call, can read files from the filesystem, search the web, run code, and chain multi-step actions. This capability profile is what the attacker needed: not a script generator but an assistant that can take actions in the environment.
The model running inside Cursor in this campaign was Claude Sonnet. The attacker's choice of Cursor likely reflects the same calculus any developer makes: it is the most capable agentic coding tool available as a consumer product, with a functioning file context, terminal integration, and web access.
The ransomware itself
After the reconnaissance and credential theft phase, the affiliate deployed a custom ransomware written in the Zig programming language with Windows and ESXi variants. The ESXi encryptor enumerates active virtual machines, force-terminates them to release disk locks, and then encrypts the virtual disk files.
What this means for defenders
Security teams should include Cursor, GitHub Copilot, and similar agentic tools in their DLP and behavioral monitoring scope. An attacker with access to a developer workstation can use these tools to accelerate intrusion activity in ways that may not look like traditional malware behavior.
Agentic tools can take actions in the environment, not just generate text. Detection logic built around 'AI generates a script that a human then runs' may miss cases where the AI is running steps directly.
ESXi continues to be a primary ransomware target. Any organization running VMware ESXi for production workloads without a tested ESXi-specific backup and recovery procedure is one compromised credential away from losing their entire VM fleet.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing AI tool risk in your enterprise environment.