Ten Targets, One AI Agent Doing the Legwork
Between April 8 and May 21, 2026, operators behind Aurora ransomware used the Cursor AI coding agent to conduct hands-on exploitation against ten confirmed targets, with CloudSEK separately identifying related activity against more than 20 organizations across nine countries between April and July. Named victims include Christeyns, Teckentrup, the Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor, and an Italian manufacturer, with Ransomware.Live listing 33 total victims spread across the United States, Germany, the Netherlands, Canada, and the United Kingdom.
What sets this apart from the general trend of criminals experimenting with AI chatbots is the operational role the agent played. Gambit Security director Eyal Sela described it plainly: "In these cases the agent was given credentials or an existing route into the victim organization. Then it was tasked with various exploitation activities." That is not a criminal asking a chatbot for advice. That is a criminal handing an agentic coding tool actual access and letting it execute a real intrusion.
What the Agent Was Actually Doing Inside Victim Networks
The Cursor Agent handled tasks that would normally require a human operator at a keyboard: installing and configuring VPN clients or proxychains to establish a foothold, running network scans with Nmap or NetExec, enumerating Active Directory domains to map user privileges, and executing NTLM relay attacks using tools like PetitPotam and Impacket. It also ran certificate-based attacks with Certipy, a technique that abuses misconfigured Active Directory Certificate Services to escalate privileges. These are standard steps in a human penetration test, just delegated to an AI agent instead of a person.
CloudSEK's researchers noted a detail that reveals operational discipline behind the automation: the operator "used Cursor, an agentic coding assistant, to plan attacks in Russian, while excluding CIS ranges and CIS-country domains, without exception." That exclusion pattern, common among Russian-language ransomware crews avoiding targets in their own region, shows the AI tooling was layered on top of an already-organized criminal operation rather than replacing operator judgment about who to target.
The ESXi Variant: Kill the VMs Before You Encrypt Them
Aurora's Linux and ESXi ransomware variant takes a specific and damaging approach: it attempts to forcefully kill every single virtual machine on a host before starting encryption. Attackers used a Python script called esxi_finder.py to scan victim networks for VMware ESXi hypervisors and vCenter servers, the infrastructure most enterprises consolidate dozens or hundreds of workloads onto. Targeting the hypervisor layer directly multiplies the blast radius of a single successful intrusion, since encrypting one ESXi host can take down every virtual machine it hosts simultaneously.
This targeting choice is consistent with a broader ransomware trend of going after infrastructure that maximizes downtime leverage rather than individual endpoints. Combined with AI-assisted exploitation handling the tedious scanning and enumeration work, the group can move from initial access to hypervisor-wide encryption faster than a fully manual operation would allow, compressing the window defenders have to detect lateral movement before the ransomware detonates.
This Is Part of a Broader Criminal Adoption Curve
Aurora is not the only ransomware operation experimenting with agentic AI tooling this year, and researchers expect the pattern to accelerate rather than stay contained to one group. The economics favor adoption: an AI coding agent that can competently run network scans, enumerate domains, and execute known exploitation techniques removes the need for a skilled human operator to handle the repetitive, mechanical parts of an intrusion. That lowers the skill floor for running a credible ransomware operation and lets smaller or less experienced crews punch above their technical weight.
It also changes what detection needs to look for. An AI agent executing PetitPotam or Certipy commands leaves largely the same forensic trail a human operator would, which means existing detection rules built around known attack techniques still apply. What changes is the speed and volume at which those techniques can be attempted, since an agent does not tire, does not need to look up syntax, and can be run against multiple targets in parallel with far less human coordination overhead than a traditional affiliate structure requires.
What This Means for Your AI Coding Tool Policy
Most enterprise conversations about AI coding agents like Cursor focus on developer productivity, code quality, and intellectual property exposure. Aurora's operators just demonstrated the same agent capability set from the attacker's side: an AI agent that can be handed credentials and a goal, then left to handle exploitation legwork with minimal human supervision. The capability that makes Cursor valuable to your engineering team, autonomous multi-step execution against a live environment, is identical to the capability that made it useful to a ransomware crew.
The roadmap implication is that AI coding agent governance cannot stop at code review and IP policy. If your organization has approved Cursor or a similar agent for developer use, the credentials and network access those agents can reach need the same segmentation and monitoring you would apply to a human contractor with broad permissions, because the agent itself has no judgment about whether the instructions it is executing are legitimate. Treat agent credential scope as an attack surface question, not just a productivity one.
