Ransomware Affiliate Uses AI Assistant for Attack Planning

A Russian-speaking affiliate of the Aurora ransomware operation has been observed using an AI coding assistant, Cursor, to aid in planning and executing cyberattacks. The discovery was made after a misconfigured server exposed detailed operational data, including tools, chat logs, and the ransomware encryptor itself. This exposed trove provided investigators with an unprecedented look into the affiliate's activities, which spanned from April to July 2026 and targeted organizations in nine countries.

The affiliate demonstrated a sophisticated approach, combining well-established Windows network abuse techniques with the efficiency offered by AI assistance. Their playbook included reconnaissance, credential theft, and lateral movement, culminating in the deployment of the Aurora encryptor. The exposed server revealed that the operator gained domain-level or interactive access at 17 of the targeted entities, with four victims ultimately appearing on Aurora's public leak site. The affected sectors included manufacturing, food, agriculture, and professional services.

Investigators noted that the affiliate used rented SOCKS proxies to infiltrate victim environments. Once inside, they employed a variety of tools for discovery, password attacks, credential harvesting, data exfiltration, and the delivery of the encryption payload. The AI assistant, Cursor, was specifically used in the later stages of the affiliate's recorded activity to draft and refine attack sequences, with chat logs showing iterative planning sessions conducted in Russian.

One particularly detailed AI-assisted engagement focused on exploiting vulnerabilities within Active Directory Certificate Services (AD CS), a critical feature for issuing digital certificates. While the underlying tactics remain familiar to defenders, the AI's ability to rapidly translate reconnaissance findings into actionable steps significantly accelerates the attack lifecycle. This allows attackers to move more swiftly through the stages of an intrusion, even when employing traditional methods.

The affiliate followed a repeatable methodology, utilizing tools like NetExec for network service examination and attempting common Active Directory attacks such as ASREPRoasting and Kerberoasting to obtain password data. They also collected sensitive information like SAM and LSA data, Group Policy exports, and BloodHound data to map the network and identify further exploitation opportunities.

For deeper network penetration, the operator employed advanced techniques including a custom noPac route, certificate service abuse, and NTLM relay attacks using tools like PetitPotam, PrinterBug, and DFSCoerce. These methods are highly effective in gaining elevated privileges and domain control, underscoring the importance for organizations to closely monitor and secure their Active Directory environments.

The Aurora ransomware itself, used by this affiliate, featured both Windows and Linux/ESXi variants built from a single Zig codebase. The Windows locker was named 'sap.exe', while the Linux and ESXi version was 'encrypt.out'. Both were deployed from a public Cloudflare R2 bucket. On Windows systems, the malware was designed to disable recovery features before encryption, while the ESXi variant targeted virtual machines, potentially impacting multiple business systems simultaneously.

Evidence from recovered negotiation data indicated that at least one victim paid the ransom. CloudSEK and TRM Labs traced these payments, identifying two confirmed victim payments and two additional payments consistent with separate victims, all laundered through shared infrastructure. To defend against such attacks, organizations are advised to disable LLMNR and NBT-NS, implement SMB signing and Extended Protection for Authentication, restrict WinRM usage, and remove SMBv1. Regular security audits of certificate templates and robust logging of certificate requests are also crucial.