Aurora ransomware affiliate used Cursor Agent (Claude Sonnet) as a hands-on intrusion operator against 10 organizations

View raw markdownEdit on GitHub ↗

TL;DR

Gambit Security's threat-intelligence team (2026-08-27) recovered evidence from exposed infrastructure showing an Aurora ransomware affiliate used Cursor Agent, running claude-4.5-sonnet-thinking, to do hands-on-keyboard intrusion work — VPN and proxychains setup, Nmap/NetExec scanning, domain enumeration, NTLM-relay coercion, and Active Directory certificate attacks — against ten organizations between 2026-04-08 and 2026-05-21, with a second cluster of eight victims across Israel, Germany, Austria, Spain, the US, and Argentina. CloudSEK independently reached months of the same operator's activity through an exposed open directory. The AI did not make the operator good — "the majority of the commands failed to achieve the stated objective on the first attempt" — but it made a mediocre operator persistent, and, as the Cloud Security Alliance's note puts it, "jailbreak resistance and misuse-detection at the AI vendor layer did not prevent sustained, multi-week interactive abuse." No vulnerability in Cursor or Claude; a data point on what "AI coding agent" means when the user is an attacker.

What happened

Gambit's report (authored by Eyal Sela) is built on visibility into infrastructure the Aurora group left exposed. In the first cluster, the operator ran Cursor Agent as an interactive assistant inside victim networks it already had a foothold in: the agent was handed credentials or an existing route in, then tasked step by step — configure a VPN client and proxychains, scan internal subnets with Nmap and NetExec, enumerate the domain, attempt NTLM relay using PetitPotam and Coerce Plus, run certificate-template attacks with Certipy. The operator's own guardrails are visible in the prompts: avoid DCSync, avoid account lockouts, do not create domain computer objects — noise-reduction instructions from someone who has been caught before. Attribution of the second cluster rests on a storage node that held data from an organization Aurora published on its leak site nine days after the transfer. The group's ransomware binary targets Linux/ESXi hosts.

The Hacker News' 2026-08-31 coverage adds CloudSEK's parallel analysis (an exposed open directory holding the toolkit, shell history, and encryptor, giving "months of activity"), the broader affiliate footprint (20+ organizations across nine countries, April–July 2026, four on the leak site), and the operator's success rate: most commands failed first time and were refined across turns — Cursor Agent being used exactly the way a developer uses it, iterating toward a working command. The CSA's 2026-09-01 research note adds that domain-level or interactive access was achieved at 17 victims, most intrusions completed in under two months, and the fastest leak-site posting came about two weeks after compromise.

A claim this sweep declined to repeat. Search-result summaries of this story assert that the operator bypassed Claude's refusals by telling the agent the intrusion was "an authorized security test." Neither Gambit's primary post nor the CSA note contains that claim, and The Hacker News attributes the only "authorized internal deployment" jailbreak quote in its article to ReliaQuest describing a different actor's tooling (the Gryxa toolkit), not Aurora. The CSA's reading is the opposite: nothing in the record shows a jailbreak; the tasks were performed as ordinary sysadmin/pentest work and the agent did them. Which is the more uncomfortable version.

Am I affected?

Not as a Cursor user — this advisory documents attacker use of the tool, not a flaw in it. The actionable audience is anyone defending an environment:

  • Cursor Agent, cursor-agent, or a Claude/Codex CLI running on a server, jump host, or VDI where no developer works is now a credible intrusion indicator, not just shadow IT. The CSA note's first recommendation is to audit outbound connections and endpoint processes for unexpected tunnelling and reconnaissance tools; add the coding-agent binaries to that list.
  • Preserve AI session logs and API histories immediately if you find unauthorized agent use — the operator's Cursor chat history is what made this attribution possible, and yours is what will make your incident response possible.
  • The technique list is standard AD tradecraft, so the standard hardening applies: disable LLMNR/NBT-NS, enforce SMB signing, restrict WinRM, audit AD CS certificate templates for the misconfigurations Certipy looks for, and watch LDAP queries against domain controllers on ports 443/902 (all per the CSA note).

For vibe coders specifically, the relevance is indirect but real: the vendor-side abuse detection that people assume backstops agentic tools did not fire across six weeks of interactive intrusion work, and that same layer is what stands between a prompt-injected agent on your machine and the same command set.

If you are affected

If a coding agent turns up somewhere it shouldn't in your environment: playbooks/if-your-webapp-was-compromised.md for scoping, then playbooks/rotating-cloud-credentials.md — the agent's session history will list every credential it was handed.

Prevention

  • prevention/agent-sandboxing.md — the CSA's framing is the right one: treat AI coding agents as privileged software that gets access controls, logging, and credential scoping like any other shell-execution automation. That applies whether the human at the keyboard is your developer or someone else's affiliate.
  • Egress and process allow-listing on servers: a coding agent's model-API traffic is distinctive and easy to alert on where it has no business being.

Sources