Report: Aurora ransomware used Cursor Agent to help breach 10 organizations
cyb3rops · x · 2026-08-27
Gambit Security's Threat Intelligence team published a report on recent Aurora ransomware activity:
- The group has been active since around April 2026, running a data leak site and targeting organizations across multiple countries;
- Between April 8 and May 21, 2026, the operator used Cursor Agent running Claude Sonnet to assist with hands-on exploitation of ten target organizations;
- They deployed a Linux ransomware variant targeting ESXi environments (hosted on Cloudflare R2 and copied manually to internal hosts), encrypting files in place with ChaCha20 and wrapping session keys with embedded RSA-4096;
- A second activity cluster was attributed to an Aurora operator with medium confidence.
Related event: Aurora Ransomware Gang Abuses Cursor Agent in Attacks on 10 Organizations(2 posts)→
More from coding & agent
- Dev bills $20,000 for an app built with $200 of Claude Code — IgorCarron · 2026-10-15
- Dan Shipper: run product and labs in parallel, even with a labs team of one — danshipper · 2026-10-15
- Gemini 4 Argon wrote 5,000+ lines of pure Python to build its own ray-tracing 3D engine — aitrendz_xyz · 2026-10-15
- Minecraft fully ported from Java to Rust, file by file, server and client included — Vjeux · 2026-10-15
- mitsuhiko builds a full Python IDE for iOS in an afternoon with new AI models — mitsuhiko · 2026-10-15
- How to get Gemini 4 Argon to build games that actually look decent — chongdashu · 2026-10-15