hacker-news Aug 31, 2026 · Crawled Sep 1, 2026

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

3 IoCs 1 Malware

AI Summary

Aurora ransomware operators, a Russian-speaking cybercrime group, have been leveraging SpaceX's AI-powered coding assistant Cursor to plan and execute attacks against at least 10 organizations between April and May 2026. The group used Cursor to assist in attack planning, including Active Directory Certificate Services exploitation, and conducted hands-on exploitation using credentials or existing access. The attack chain includes initial access via email bombing and social engineering, lateral movement using SMB, LDAP, RDP, and RPC, privilege escalation, evasion of security tools, data exfiltration, and deployment of a multi-platform encryptor written in Zig. A related AI-assisted toolkit called Gryxa has also emerged, enabling persistent access, credential theft from Chromium browsers, and evasion of endpoint protection.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Aurora →

Indicators of Compromise 3 extracted

Type	Value	Detail
Filename	sap.exe	Details →
Filename	encrypt.out	Details →
Filename	esxi_finder.py	Details →

MITRE ATT&CK TTPs 21 techniques

T1003 OS Credential Dumping · Credential Access T1014 Rootkit · Defense Evasion T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1078 Valid Accounts · Defense Evasion T1083 File and Directory Discovery · Discovery T1090 Proxy · Command And Control T1133 External Remote Services · Persistence T1482 Domain Trust Discovery · Discovery T1486 Data Encrypted for Impact · Impact T1490 Inhibit System Recovery · Impact T1531 Account Access Removal · Impact T1550 Use Alternate Authentication Material · Defense Evasion T1558 Steal or Forge Kerberos Tickets · Credential Access T1562.001 Disable or Modify Tools · Defense Evasion T1566 Phishing · Initial Access T1573 Encrypted Channel · Command And Control