Aurora Ransomware Abuses Cursor Agent for ESXi Attacks
cyb3rops · x · 2026-08-28
A report by Gambit Security reveals that the Aurora ransomware group has abused Cursor Agent (running Claude Sonnet) to assist with hands-on exploitation across ten target organizations. The attackers leveraged the AI tool to aid in compromising ESXi environments between April and May 2026. The report details the group's tactics, including the manual deployment of a Linux ransomware variant targeting ESXi hosts. This marks a significant shift where attackers integrate AI agents into their exploit toolchains.
Related event: Aurora Ransomware Gang Abuses Cursor Agent in Attacks on 10 Organizations(2 posts)→
More from coding & agent
- AI software factories hinge on the Factory Loop, not faster code generation — Pavan_Belagatti · 2026-10-16
- 'Dropping a 3,000-line PR twenty minutes after ticket assignment' — AI coding meme goes viral — facontidavide · 2026-10-16
- Self Labs launches Agent Vault to let AI agents log in and pay with credit cards — EXM7777 · 2026-10-16
- Plane Agents: triggers, not prompts, are what turn chatbots into workflow agents — JosephJacks_ · 2026-10-16
- Claude eng lead Felix Rieseberg publishes tutorial on being more ambitious with AI — danshipper · 2026-10-16
- Qwen Code Desktop v0.25.2 ships managed-agent fixes and MCP config repair — github-actions[bot] · 2026-10-16