Aurora Ransomware Used Cursor AI to Plan Attacks

A Russian-speaking ransomware affiliate used the popular AI coding assistant Cursor to plan and refine intrusions against more than 20 organizations across nine countries, according to an analysis published this week by the security firm CloudSEK. The affiliate, tied to the Aurora ransomware operation, left an unusually complete record of its work exposed on a misconfigured server — including chat logs showing the attacker asking an AI tool, in plain language, how to escalate privileges and move through victim networks.

The finding is the latest and one of the most concrete data points in a trend security researchers have tracked all year: criminals reaching for the same commercial AI tools that developers use, and bending them toward intrusion. Where earlier cases showed attackers using chatbots to polish phishing lures or draft scripts, the Aurora record shows an AI coding assistant woven directly into the operational planning of a live ransomware campaign.

How investigators found it

The break in the case came not from a leaked tool or an informant but from the attacker’s own sloppiness. CloudSEK says a wrongly exposed server — left reachable on the public internet without authentication — gave investigators an end-to-end view of the operation, “from intrusion to payment.”

The server was, in effect, the affiliate’s working directory. According to the analysis, it contained:

• Victim-specific directories, one per target, holding the operator’s notes and loot
• Shell history documenting exactly what commands were run
• Kerberos tickets and credential dumps harvested from compromised Active Directory environments
• Group Policy exports and BloodHound collections — the standard reconnaissance artifacts attackers use to map a Windows network and find paths to domain admin
• Custom tools and Aurora ransomware binaries ready for deployment
• Cursor chat logs capturing the affiliate’s conversations with the AI assistant

That last item is the headline. The chat logs, CloudSEK says, show the operator using Cursor — an AI-powered code editor built by Anysphere — to draft and refine attack sequences, with prompts and responses recorded in Russian. One extended session, the firm reports, focused on exploiting weaknesses in Active Directory Certificate Services (AD CS), the Windows feature that issues digital certificates and a well-known avenue for privilege escalation when misconfigured.

What the affiliate did

CloudSEK’s reconstruction describes a campaign running from roughly April to July 2026. The operator, it says, gained domain-level or interactive access at 17 of the targeted organizations, and four victims were ultimately named on Aurora’s public leak site — the extortion pressure tactic in which stolen data is threatened with publication if a ransom goes unpaid. The affected organizations spanned manufacturing, food, agriculture, and professional services.

Separately, Reuters reported — citing the security firm Gambit Security — that the same Aurora-linked actor, tracked as “Aur0ra,” used Cursor to help breach at least seven companies, including a Belgian chemical company, between early April and late May. The two accounts describe overlapping activity and reinforce the same core finding: an AI coding assistant was a routine part of the attacker’s toolkit, not a one-off experiment.

Crucially, the AI did not replace the human operator. The picture from the artifacts is of a skilled affiliate using Cursor as a force multiplier — asking it to draft exploitation steps, troubleshoot failed commands, and adapt tradecraft to each environment, then executing the results by hand. That is a different threat model from a fully autonomous “agentic” ransomware attack run end to end by a model, which researchers documented separately earlier this summer. Both point the same direction, but the Aurora case is the more common shape today: a person in the loop, with an AI assistant accelerating the parts that used to require deep expertise.

Why an AI assistant matters to attackers

The value of a tool like Cursor to a ransomware operator is the same as its value to a developer — it lowers the skill floor and speeds up the work.

Historically, the hands-on-keyboard phase of a ransomware intrusion has been the bottleneck. Moving laterally through a Windows domain, chaining an AD CS misconfiguration into domain admin, and cleaning up after each step requires experienced operators, and experienced operators are scarce. That scarcity has been one of the few natural brakes on how fast ransomware crews can scale.

An AI coding assistant chips away at that brake. It can explain an unfamiliar technique, generate the exact command for a given environment, and diagnose why an attack step failed — in the operator’s native language, on demand. It compresses the learning curve that used to separate elite affiliates from mediocre ones. For a ransomware-as-a-service ecosystem that runs on volume, anything that makes affiliates more capable makes the whole operation more dangerous. It is the same dynamic behind other cases where attackers have leaned on AI to run real-world intrusions.

The guardrail problem

The uncomfortable question the Aurora case raises is how a mainstream, safety-conscious AI coding tool ends up drafting Active Directory attack sequences in a criminal’s chat window. AI providers build refusal behavior into their models precisely to prevent this, but coding assistants sit in a gray zone: the same request — “help me exploit AD CS,” “escalate privileges on this domain” — is legitimate for a penetration tester or red-team engineer and malicious for a ransomware affiliate, and the tool cannot always tell which is which from the prompt alone.

That ambiguity is the crux of the “dual-use” problem now facing every AI vendor. Blanket refusals frustrate the security professionals who are among these tools’ most valuable users; permissive behavior hands capability to attackers. The Aurora logs are a concrete example of the failure mode vendors most want to avoid, and they will intensify pressure on AI companies to detect abuse patterns — repeated exploitation queries, credential-handling requests, ransomware-adjacent workflows — without breaking legitimate use.

What it means

The Aurora case is not a story about a new, unstoppable weapon. The underlying tradecraft is ordinary — exposed services, credential theft, Active Directory escalation, double-extortion leak sites. What is new is the assistant sitting next to the operator, turning knowledge that used to take years to acquire into a chat prompt. That is the practical face of “AI-assisted attacks” in 2026: not autonomous killer software, but competent criminals made faster and more capable.

Who is exposed: the same organizations that were exposed before — those running unpatched internet-facing services, weak Active Directory configurations, and misconfigured certificate services. AI does not create these weaknesses; it helps attackers find and exploit them more efficiently. The defensive priorities are unchanged and unglamorous: patch external services, harden AD CS, monitor for BloodHound-style reconnaissance, and assume credential theft.

Who is on the hook: AI vendors, who now have a documented example of their tools inside a live ransomware operation and will face renewed calls to detect and disrupt abuse. Expect more investment in usage monitoring and abuse detection, and more debate over how to serve legitimate security researchers without arming the people they defend against.

What to watch next: whether other ransomware crews follow Aurora’s lead and standardize on AI coding assistants — CloudSEK’s exposed-server windfall suggests this is already common and merely undocumented — and how quickly AI providers respond. The exposed server that unraveled this campaign was a lucky break for defenders. The next affiliate is unlikely to leave the door open, which means the AI chat logs that made this case legible may be the exception, not the rule. Defenders should plan for the capability, not the carelessness.