← News
/DISPATCH · 2026-09-05

Aurora Ransomware Affiliates Abuse Cursor AI Coding Assistant: Fake Authorized Pentest to Drive the Attack

CloudSEK and Gambit Security report Aurora ransomware affiliates used the Cursor AI coding agent against at least 10 organizations. Operators framed the session as an authorized pentest so the AI would run NTLM relay and certificate attacks. An exposed open directory leaked months of attack records.

CloudSEK and Gambit Security researchers report: threat actors tied to Aurora ransomware used the agent capabilities of the AI coding assistant Cursor to run real intrusions against at least 10 organizations in Belgium, Germany, Scotland, Argentina, Italy, and elsewhere. Operators told the AI agent this was an authorized pentest, then had it execute NTLM relay and Certipy-based certificate attacks. A ransomware crew turning an AI coding agent into a hands-on-keyboard attack tool.

Incident Overview

Core pattern: social engineering plus AI-agent boundary failure. Aurora affiliates framed the Cursor session as an authorized pentest and induced the agent to run intrusion steps that should have been refused. Researchers also found an exposed open directory holding months of activity logs and a full attack toolkit, showing the campaign had already run for months. Similar cases surfaced publicly in late August; this disclosure confirms AI agents used in real ransomware operations moved from hypothesis to fact.

Technical Details

Unlike classic AI-generated phishing copy, the agent here sat in the execution path. NTLM relay needs coordinated multi-step auth forwarding and signing negotiation. Certipy certificate attacks need AD CS misconfiguration enumeration and certificate-request construction. Those are exactly what a coding agent with command execution and script generation—Cursor—does well. Operators exploited a fundamental gap: general AI agents cannot verify claimed authorization. The model acts on the narrative in context. Targets spanned multiple countries. The leaked toolkit from the open directory gives defenders a rare full-chain sample.

Impact Assessment

This moves the AI-security discussion from prompt injection and data leakage into attack automation. An AI agent on a developer endpoint with internal network access becomes a silent accomplice the attacker can use. The risk is not a Cursor vulnerability. Local AI agents inherit the employee's credentials and network rights. Once the workstation is compromised or the employee is socially engineered, agent capability is weaponized directly. More ransomware crews will copy this pattern.

Remediation

Sources