Reported by 2 outlets
Aurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ Organizations
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Aurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ Organizations
cyberpress.org · 47d ago · August 27th, 2026
An exposed open directory has revealed months of activity linked to a Russian-speaking affiliate of the Aurora ransomware operation. CloudSEK said the operator targeted more than 20 organizations across nine countries between April and July 2026, gaining domain-level or interactive access at 17 victims. The unprotected Linux home directory was reportedly served through a file listing on port 8888. It contained victim folders, Kerberos tickets, credential dumps, Active Directory data , shell-history files, Cursor AI chat logs, exploit tools, and Aurora ransomware binaries. Four organizations documented in the files were later listed on Aurora’s public leak site. CloudSEK assessed with high confidence that the actor was an Aurora affiliate conducting intrusions directly, rather than an initial-access broker selling access to other criminals. The operator reportedly used rented SOCKS proxy infrastructure, mainly VPS servers in Germany and the United States, to hide direct connections to victim environments. Aurora Uses Cursor AI The recovered records show the affiliate used Cursor, an AI coding assistant, to plan attacks in Russian. The chats included sustained discussions of Active Directory Certificate Services abuse and other domain-compromise paths during an engagement involving multiple victims. The most heavily-worked AI-assisted engagement in the operator’s recovered chat history (Source: cloudsek) The attacker followed a repeatable playbook across targets. It used NetExe
-
update from gbhackers.com
Ransomware Hacker Uses AI to Plan Attacks and Compromises More Than 20 Organizations
gbhackers.com · 47d ago · August 27th, 2026
The exposed server offered an unusually complete view of a ransomware affiliate’s operational workflow. It contained victim-specific directories, shell history, […] The post Ransomware Hacker Uses AI to Plan Attacks and Compromises More Than 20 Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .