Ransomware Hacker Uses AI to Plan Attacks and Compromises More Than 20 Organizations

**Executive summary:** A Russian-speaking affiliate of the Aurora ransomware operation used an AI coding assistant (Cursor) to plan intrusions, achieved domain-level access in many networks, exfiltrated large data sets, and deployed Aurora encryptors (Windows and Linux/ESXi written in Zig) across more than 20 organizations in nine countries; researchers recovered extensive operational artifacts, IOCs (hashes, onion address, IPs), and evidence of ransom payments and laundering infrastructure.