Aurora ransomware affiliate was planning its intrusions into Cursor, in Russian

CloudSEK analyzed one exposed server: twenty compromised organizations in nine countries between April and July, with the AI Code Assistant as the attack co-pilot.

The discovery was due to negligence: a server left accessible, containing the entire work plan of a Russian-speaking affiliate of Operation Aurora. CloudSEK researchers found directories by victim, shell history, Kerberos tickets, credential dumps, Group Policy exports, BloodHound collections, homemade tools, ransomware binaries — and conversation logs with Cursor.

It is this last element that distinguishes the case. The operator used the agent code assistant to order its attack sequences and reason about its elevation of privilege movements in Active Directory, formulating its queries in Russian. Between April and July 2026, more than twenty organizations across nine countries were compromised, with domain-level access or an interactive session obtained in at least seventeen environments. Manufacturing dominates the list of victims, ahead of food and beverage, professional services, transportation and logistics, consumer goods, waste management, and IT infrastructure.

Only four victims were published on the Aurora leak site, suggesting that the majority of cases were settled elsewhere. By collaborating with TRM Labs on the tracing of cryptocurrency payments, CloudSEK also reconstructed the ransom sharing between the affiliate and the operation, ranging from 35/65 to 46/54.