Security researchers have uncovered a striking development in the tactics of the Aurora (Aur0ra) ransomware group: they’re using AI agents built on Cursor, combined with models from Anthropic, xAI, and Moonshot, to escalate access and steal sensitive data. Previously known for using AI in planning phases, the group has now handed off parts of their intrusion playbook to automated agents. These agents were tasked with moving from stolen credentials to domain administrator control on Windows networks, before exfiltrating files and preparing for ransomware deployment.
How the Attack Chain Played Out
The operation starts with human operators providing preexisting access—via VPN credentials—and target goals. Once in the network, Cursor-based agents take over roles traditionally handled by skilled attackers: mapping subnets, discovering paths to high-value accounts, moving laterally between machines, and leafing through shared storage. Between the work done by Cursor’s Composer model and those from Anthropic and others, almost all the heavy lifting is outsourced.
To bypass AI safety protocols, the group disguised these maneuvers as legitimate diagnostics or red team testing. They carried out credential attacks like password spraying, Kerberoasting, NTLM relay/coercion, and relic use. Tools such as SharpShares, NetExec, BloodHound, PetitPotam, Coerce Plus, PrinterBug, and Certipy were found in the attack chain—many of which overlap with known methods used by other threat actors. In one case, stolen data was pushed to an S3-compatible storage server; logs suggest the operators may be Russian speakers, due to use of a Cyrillic keyboard layout.
Shared Infrastructure and Indicators
The reveal came after Sophos examined an AI-augmented testing framework tied to Cursor. The same infrastructure was then observed in Aur0ra’s ransomware operations. Several open-source reports from Gambit Security and CloudSEK in late August found exposed directories containing versions of the Aur0ra ransomware, shell histories, and agent chat logs. One agent employed Claude 4.5–Sonnet in semi-automated intrusions—highlighting how crews are mixing and matching AI capabilities.
Key indicators of compromise (IoCs) include listed IP addresses associated with exfiltration servers, command-and-control infrastructures (Cobalt Strike servers), SOCKS proxy nodes, and exposed open directories. A notable exfiltration endpoint was flagged as being hosted at 152[.]236[.]4[.]14, among others. Analysts say these overlaps help trace the expanded tooling and reveal the degree of automation at play.
Recommendations and Implications
Security firms warn that Aur0ra’s approach lowers the technical bar for executing high-impact network intrusions. To defend against this emerging threat, they urge firms to harden their Active Directory environments, deploy strong patching practices for external-facing systems, enforce phishing-resistant multi-factor authentication, tighten access to domain admin rights, isolate backups, and segment critical infrastructure. Application whitelisting and vigilant monitoring of endpoint detection and response (EDR) logs are essential.
As attackers use AI agents to move faster, defenders must compress incident response times. The shift from human-only tactics to agent-assisted operations means that breaches can escalate in hours rather than days. Organizations need threat intel, intrusion simulations, and least-privilege principles to stay ahead.
In short, the Aur0ra gang’s workflow represents a broader trend: AI agents are becoming central players in ransomware operations, not just planning tools. Letting credentials linger is no longer the worst misstep—allowing AI-assisted escalation unchecked is fast becoming the defining threat vector.
