Malware

Aurora

Also known as: OneKeyLocker

Ransomware

Indicators of Compromise 3

Filename encrypt.out Filename esxi_finder.py Filename sap.exe

MITRE ATT&CK TTPs 21

OS Credential Dumping

Credential Access

Defense Evasion

Remote Desktop Protocol

Lateral Movement

SMB/Windows Admin Shares

Lateral Movement

Distributed Component Object Model

Lateral Movement

Process Injection

Defense Evasion

Clear Windows Event Logs

Defense Evasion

Defense Evasion

File and Directory Discovery

Command And Control

External Remote Services

Domain Trust Discovery

Data Encrypted for Impact

Inhibit System Recovery

Account Access Removal

Use Alternate Authentication Material

Defense Evasion

Steal or Forge Kerberos Tickets

Credential Access

Disable or Modify Tools

Defense Evasion

Encrypted Channel

Command And Control

Source Articles

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora ransomware operators, a Russian-speaking cybercrime group, have been leveraging SpaceX's AI-powered coding assistant Cursor to plan and execute attacks against at least 10 organizations between April and May 2026. The group used Cursor to assist in attack planning, including Active Directory Certificate Services exploitation, and conducted hands-on exploitation using credentials or existing access. The attack chain includes initial access via email bombing and social engineering, lateral movement using SMB, LDAP, RDP, and RPC, privilege escalation, evasion of security tools, data exfiltration, and deployment of a multi-platform encryptor written in Zig. A related AI-assisted toolkit called Gryxa has also emerged, enabling persistent access, credential theft from Chromium browsers, and evasion of endpoint protection.

hacker-news ·15h ago