An affiliate of the Aurora ransomware group has leveraged artificial intelligence to plan and carry out attacks against corporate environments, with a primary focus on Active Directory and VMware ESXi servers.
The operation affected more than 20 organizations between April and July 2026. Investigators found that the threat actor relied on Cursor, an AI programming assistant, to develop commands, adjust exploitation techniques, and construct attack sequences targeting Windows infrastructure.
One of the main targets was Active Directory Certificate Services (ADCS). The operator used AI assistance to refine privilege escalation attacks and identify paths that could lead to administrative accounts or full domain control.
The campaign also featured exploitation of the noPac vulnerability and NTLM relay attacks using tools such as PetitPotam, PrinterBug, and DFSCoerce. In several environments these techniques enabled the attackers to reach domain administrator privileges.
After consolidating access, the criminals collected and compressed large volumes of data before exfiltration. The Aurora ransomware was then deployed across Windows, Linux, and VMware ESXi servers. The ESXi variant stops virtual machines before encryption to increase impact on virtualized infrastructures. On Windows systems the malware also attempts to delete shadow copies and disable recovery mechanisms.
