Aurora Ransomware Used an AI Coding Assistant to Plan Your Breach

The recovered chat history is what makes this case different.

CloudSEK and Gambit Security independently analyzed exposed infrastructure belonging to an Aurora ransomware operator. The exposure was an open directory leak — months of toolkit files, shell history, encryptor binaries, and chat logs. What the chat logs showed was an operator using Cursor, an AI-powered coding assistant, to plan attack phases in Russian.

Not to write malware. Not to automate scanning. To plan: target prioritization, lateral movement sequences, a complete Active Directory Certificate Services (AD CS) exploitation plan — the kind of attack methodology that previously required deep domain expertise to develop — drafted with an AI assistant, in a chat interface, in Russian.

The same tool your developers use to write code. Used to plan how to compromise your network.

The Aurora Attack Chain

Aurora is a ransomware-as-a-service operation. Its affiliates — independent operators who pay to use the group's infrastructure and encryptor — carry out intrusions and split ransom proceeds with the administrators. Recovered cryptocurrency wallet data shows affiliates receiving between 54% and 79% of payments. The split variation suggests Aurora negotiates affiliate terms individually based on the quality of targets brought.

Black Hills Information Security documented a representative Aurora intrusion. Initial access began with aggressive email bombing — flooding a target employee with thousands of emails to create confusion and urgency. The attackers then called the employee directly, impersonating IT helpdesk personnel offering to help resolve the email issue. The employee allowed the caller to install Xray-core, an open-source remote access utility, granting the attacker a foothold inside the network.

From there, the chain is methodical. Lateral movement through SMB, LDAP, WinRM, RDP, and RPC. Escalation to high-privilege administrator accounts. Detection evasion by clearing event logs and disabling Microsoft Defender via registry modifications. Data exfiltration before encryption. Then deployment of the encryptor.

The Windows encryptor inhibits recovery by deleting volume shadow copies and disabling System Restore directly through the registry. The Linux/ESXi variant terminates every virtual machine on the host before starting encryption — preventing administrators from migrating VMs to safety once the attack is detected. Both variants are Zig-compiled from a single shared codebase, giving Aurora cross-platform capability from one development effort.

What AI Changes About Ransomware

The Aurora operator did not use Cursor to build new malware. The encryptor, the lateral movement tools, the access utilities — those were already built. What the operator used Cursor for was attack planning: translating a target environment into a sequenced intrusion plan.

This distinction matters for how defenders think about the AI threat to their environments. AI-assisted attacks are not primarily about new techniques. They are about lowering the expertise threshold for executing existing techniques correctly and at speed.

AD CS exploitation is a clear example. The attack paths documented by researchers — misconfigured certificate templates that allow privilege escalation or domain impersonation — have been publicly known since 2021. The techniques work against a large percentage of Active Directory environments because AD CS is complex, poorly understood by most administrators, and deployed with default configurations that introduce exploitable conditions. Historically, executing an AD CS attack required understanding both Active Directory internals and certificate infrastructure. With an AI assistant, an operator can generate a functional exploitation sequence from a prompt describing the target environment.

The practical implication: Aurora affiliates who previously lacked the technical sophistication to exploit AD CS can now do so. The pool of actors capable of executing this class of attack has expanded. The speed at which they can adapt an attack plan to a specific target environment has increased.

Your detection program was designed for the attack velocity of human experts working without AI assistance. That baseline has shifted.

What Your SOC Should Check This Week

Enumerate your AD CS certificate templates for exploitable misconfigurations. Run Certipy or a similar tool against your environment to identify templates that allow requestor-specified subject alternative names, over-permissive enrollment rights, or EKU combinations that enable authentication. Most AD CS deployments have at least one exploitable template. Find yours before Aurora does.

Verify your helpdesk authentication controls for remote access requests. Aurora's entry point is social engineering: email bombing to create urgency, then a phone call offering help. Your helpdesk should have a defined procedure for verifying caller identity before providing remote access — not just for external callers, but for any request that does not originate from a tracked ticket. Validate that this procedure exists and that helpdesk staff know it.

Confirm Defender alerts are processed before the service can be disabled. Aurora disables Defender before encryption. This is a detectable event: registry modifications to disable real-time protection, service termination, or tamper protection bypass attempts all generate alerts or audit events. The question is whether those alerts are being processed in time to matter. Review your alert pipeline for endpoint protection tampering events specifically.

Check your ESXi backup and recovery posture. The Aurora Linux variant kills all VMs before encrypting. If your VM snapshots are stored on the same storage array as the running VMs, they will be encrypted alongside them. Verify that your ESXi backups are stored offline or in a separate environment that an attacker with hypervisor access cannot reach.

Monitor for volume shadow copy deletion and System Restore registry modifications. Both are consistent pre-encryption steps across virtually all modern ransomware families, not just Aurora. Detection rules for vssadmin delete shadows, wmic shadowcopy delete, and the specific registry keys used to disable System Restore should be standard in your SIEM. If they are not, add them before the next incident.