Threat Overview
Security reporting published August 27–28, 2026 described Aurora ransomware operators using Cursor Agent, powered by Claude Sonnet, during real intrusions. Reuters reported that Russian-speaking cybercriminals used the AI coding assistant against at least seven companies, while Gambit Security reporting summarized by SC Media and Infosecurity Magazine described activity across at least 10 victims between April 8 and May 26, 2026.
The operators reportedly supplied the agent with credentials or existing access and used it for post-compromise reconnaissance, host scanning, privilege checks, NetExec and Nmap execution, certificate-service attacks with Certipy, VPN installation, and proxychains configuration. This was not autonomous initial compromise: the actor already had credentials or network access and used the AI tool to accelerate operator tasks.
The same reporting describes a Linux ransomware variant targeting VMware ESXi, encrypting virtual-machine files while leaving the hypervisor bootable to display ransom instructions. Exact payload hashes, infrastructure, and full encryption implementation were not reliably published in the reviewed sources, so the hunt focuses on behavior rather than unsupported IOCs.
References
Impacted Systems
| Threat actor / campaign | Aurora ransomware operators |
| Observed victim count | At least 7 companies in Reuters reporting; other reporting cites at least 10 victims |
| Observed period | April 8 through May 26, 2026 |
| Required attacker state | Existing credentials or established victim-network access |
| AI tooling | Cursor Agent using Claude Sonnet |
| Observed tools | Nmap, NetExec, Certipy |
| Connectivity changes | VPN client installation and proxychains configuration |
| Ransomware platform | Linux variant targeting VMware ESXi |
| ESXi impact | Encrypts VM files while keeping the hypervisor bootable |
| Known activity | Confirmed intrusion activity; no complete stable IOC set was published in the reviewed sources |
Why this matters
The campaign combines common post-compromise behaviors that remain visible in endpoint, identity, network, and VMware telemetry. The AI component changes operator speed, not the observable behaviors: scanning, credential abuse, AD CS attacks, tunneling, and ESXi encryption remain huntable.
Exploitation Status
Confirmed campaign activity. Reporting establishes use of Cursor Agent during intrusions and use of Aurora Linux ransomware against VMware ESXi. Exact victim counts vary by source scope, and no single complete stable IOC set was confirmed.
What this hunt looks for
NetExec, Nmap, and Certipy execution; shell-based reconnaissance; newly installed VPN or proxy tooling; offensive-tool network activity; bulk ESXi virtual-machine file modification; and suspicious VMware/Linux shell activity.
Required logs
DeviceProcessEventsDeviceNetworkEventsDeviceFileEventsSecurityEventfor Windows process-creation fallbackSyslogand VMware/ESXi telemetry where ingested
Hunt 1 — First-Pass: NetExec, Nmap, and Certipy Execution
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("nmap.exe","nmap","netexec.exe","netexec","nxc.exe","nxc","certipy.exe","certipy")
or ProcessCommandLine has_any ("netexec"," nxc ","certipy","nmap -","nmap.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascHunt 2 — Reconnaissance Commands From PowerShell or Shell
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","bash","sh")
| where ProcessCommandLine has_any ("whoami","ipconfig","ifconfig","net user","net group","nltest","dsquery","Get-AD","arp -","route print","systeminfo","hostname","ss -","netstat")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by TimeGenerated ascHunt 3 — VPN or Proxy Tool Installation / Execution
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName has_any ("openvpn","wireguard","tailscale","zerotier","cloudflared","proxychains")
or ProcessCommandLine has_any ("openvpn","wireguard","wg-quick","tailscale","zerotier","cloudflared","proxychains")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| sort by TimeGenerated ascHunt 4 — Certipy-Like AD CS Enumeration and Abuse
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine has "certipy"
| where ProcessCommandLine has_any (" find "," req "," auth "," shadow "," relay "," ca "," template ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated ascHunt 5 — Public Network Connections From Offensive Tools
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("nmap.exe","nmap","netexec.exe","netexec","nxc.exe","nxc","certipy.exe","certipy","cloudflared.exe","cloudflared","openvpn.exe","openvpn")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated ascHunt 6 — Bulk ESXi VM File Modification
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any ("/vmfs/volumes/","\vmfs\volumes\")
| where FileName endswith ".vmdk" or FileName endswith ".vmx" or FileName endswith ".vmsd" or FileName endswith ".nvram"
| where ActionType in ("FileModified","FileRenamed","FileDeleted")
| summarize Files=dcount(FileName), Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated,10m)
| where Files >= 5 or Events >= 20
| sort by Events descHunt 7 — ESXi / Linux Syslog for Suspicious VM and Shell Activity
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("/vmfs/volumes/","vim-cmd","esxcli","pkill","killall","openssl","nohup","chmod +x","wget ","curl ")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated ascHunt 8 — Windows 4688 Fallback for Recon / Offensive Tooling
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where CommandLine has_any ("netexec","nxc","certipy","nmap","whoami","nltest","dsquery","proxychains","cloudflared","openvpn")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated ascDetection Notes
- The AI agent itself may not appear in endpoint telemetry if the attacker runs it remotely. Hunt the commands and tooling it causes to execute.
- NetExec, Nmap, Certipy, VPN software, and proxy tools can be legitimate in administrative or security-testing environments.
- ESXi file telemetry may not be available through Defender tables; Syslog and VMware-specific logs are important fallbacks.
- Bulk VMDK/VMX modifications can overlap with backup, snapshot, storage, or migration operations.
- No stable Aurora payload hashes or C2 infrastructure were verified in the reviewed reporting.
Killian Sherer 