A recently exposed set of tools and communication logs has shed light on how the Aurora ransomware group leveraged AI to plan cyberattacks targeting over 20 organizations between April and July 2026 across nine countries. The actor—affiliated with Aurora—used an AI-based coding assistant (“Cursor”) to design and refine attack strategies in Russian, supplementing a playbook of traditional ransomware tactics. The victims span industries including manufacturing, agriculture, food production, and professional services.
How Attack Planning Unfolded
Investigators accessed a misconfigured server that revealed the affiliate’s full intrusion chain—everything from discovery and credential theft to encryption tools and payment demands. The directory exposed internal tools, command histories, credential material, and chat records with the AI assistant, along with the Aurora encryptor itself. The activities revealed were consistent with the work of an active affiliate rather than a broker selling access to compromised networks.
During the planning phase, the affiliate relied on Cursor in later weeks to craft a playbook in Russian: outlining attack sequences, selecting tactics, and adapting approaches for specific victims. One session detailed plans to abuse Active Directory Certificate Services after reconnaissance. Common steps included network service discovery via NetExec, data collection (including SAM, LSA, BloodHound exports), and attacks like ASREPRoasting and Kerberoasting to extract credential data for offline cracking.
Tools, Techniques & Damage
Once inside victim environments—17 of them with domain-level or interactive access, and four additionally exposed on Aurora’s leak site—the threat actor deployed Aurora’s ransomware across Windows, Linux, and ESXi systems. The malware was built on a single Zig codebase, with binaries named “sap.exe” for Windows and “encrypt.out” for Linux/ESXi. The Windows version tried to eliminate recovery features like volume shadow copies and System Restore; the ESXi version shut down virtual machines before encrypting VM files.
Two payments have been confirmed; two more matching patterns of known victims are also under investigation. The attacker used rented SOCKS proxies and various exploits, including certificate-service abuse, NTLM relay exploits, and tools like PetitPotam, PrinterBug, and DFSCoerce. Victim networks were also hit with credential theft, domain policy exports, and exploitation of weak Active Directory setups.
Prevention & Defence Guidance
Security researchers recommend organizations eliminate or restrict use of SMBv1, enforce credential hygiene, and segment networks so admin tools like WinRM are tightly controlled. Protections like SMB signing and disabling NetBIOS and llmnr/NBT-NS name services are also advised. Domain control should be guarded carefully: reviewing certificate templates, auditing certificate issuances, rotating krbtgt passwords fully across domains when compromise is suspected, and isolating legacy systems or failing infrastructure.
A set of indicators of compromise (IoCs) was provided—including the SHA-256 hashes of the Windows and Linux encryptors, hexlane IP addresses used for command-and-control, and the Aurora Tor negotiation site—that defenders can use to hunt for this activity in their networks.
This case exemplifies a broader trend: threat actors are increasingly using AI tools not just for automation, but for refining strategy and accelerating decision-making in multistage attacks. By folding AI into each step—from planning and reconnaissance to deployment—ransomware groups are reducing the time defenders have to detect and disrupt their operations.
What to watch going forward: tighter security around Active Directory Certificate Services, more monitoring of AI assistant artifacts in threat intelligence, and adjusted incident response playbooks that assume attackers might come equipped with strategic AI support. Recognition of this shift is the first step toward building stronger, proactive defenses in a fast-evolving threat landscape.
