Aurora Ransomware Employs SpaceX’s AI Cursor Agent in Sophisticated Exploitation Campaigns
In a detailed report released by Gambit Security’s Threat Intelligence team, it has come to light that actors associated with the Aurora ransomware group have been leveraging SpaceX’s AI Cursor Agent to facilitate their malicious exploitation efforts. This alarming revelation showcases a notable trend in cybercrime where advanced tools, typically employed for legitimate purposes, are being misappropriated by threat actors.
The study indicates that from April 8 to May 26, 2026, Aurora operators executed a series of attacks against ten distinct victims utilizing Cursor Agent, a powerful tool traditionally harnessed by software developers to automate complex coding tasks and run terminal commands. By integrating Claude Sonnet—a variant of the AI Cursor Agent—into their operations, these cybercriminals were able to enhance their activities significantly, enabling more efficient reconnaissance and exploitation techniques.
The specific tasks undertaken with Cursor Agent involved meticulous scanning of the victims’ environments, installing VPN clients, and executing certificate-based attacks. Though it is noted that Cursor Agent did not always meet its intended objectives on the first attempt, the research underscores the persistent experimentation by these threat actors with AI-driven tools. This adaptability is becoming an essential characteristic of modern cybercriminal campaigns aimed at maximizing their efficacy.
The Mechanics of Exploitation
Aurora operators employed Cursor Agent primarily for post-compromise activities. In this phase, the attackers facilitated the integration of the tool by providing it with valid credentials or an existing route into the victim’s infrastructure. The commands transmitted to the agent varied, with some aiming for simple intelligence-gathering tasks, while others involved specific instructions tied to exploitation tools. For instance, a command might involve asking the Cursor Agent, “What rights does the user have?” demonstrating a clear focus on understanding access privileges within the targeted environment.
More complex instructions were also relayed to the AI agent, such as detailing which exploitation tool to utilize or adhering to a pre-established attack plan. This included enumerating domains to elucidate the privileges associated with a given user, employing NetExec’s BloodHound collector, and conducting internal subnet scans using applications like Nmap or NetExec.
The exploitation activities assigned to Cursor Agent covered a range of sophisticated tactics, including attempting NTLM relay attacks through tools like PetitPotam, Coerce Plus, and PrinterBug, as well as conducting certificate attacks using Certipy. Furthermore, the agent was instructed to install a VPN client or configure proxychains, connecting to the victim with supplied authentication details or utilizing an existing SOCKS tunnel.
According to the Gambit researchers, "The majority of the commands failed to achieve the stated objective on the first attempt, leading to numerous refinements and adjustments to the commands and scripts for each task." While some attempts ultimately succeeded, others concluded with merely a report detailing the failures, indicating an ongoing learning process within the operational framework of these ransomware actors.
A New Threat Variant for ESXi Environments
In an extension of their findings, the Gambit study, published on August 27, also reported the emergence of a new variant of the Aurora ransomware specifically designed to breach Linux-based ESXi environments. This new iteration marks a strategic expansion in the capabilities of Aurora, allowing it to target VMware ESXi hypervisors and vCenter servers. The attackers utilized a custom script named esxi_finder.py, derived from a NetExec LDAP module, to systematically scan victim networks for such pivotal infrastructure components.
One alarming feature of this new variant is its ability to encrypt virtual machine files while deliberately avoiding system volumes. This strategic oversight enables the hypervisor to remain bootable, thus allowing victims to access the ransom demand even when crucial files have been compromised.
Furthermore, Gambit researchers observed a second wave of activity that they attribute to Aurora operators, with medium confidence, targeting eight victim organizations across diverse locations, including Israel, Germany, Austria, Spain, the United States, and Argentina. Since its emergence in April 2026, Aurora ransomware has been consistently active, operating a data leak site alongside targeting numerous organizations worldwide.
As the understanding of Aurora’s operation expands, it becomes increasingly clear that the ransomware group is evolving in both its methodology and tools by adopting sophisticated technologies that were once the exclusive purview of legitimate software development. This pivot underscores a critical need for enhanced defense measures among organizations to thwart these emerging threats.