Aurora Ransomware Hackers Use Cursor AI Agent for Hands-On Exploitation and ESXi Attacks

Aurora ransomware operators used an AI agent (Cursor Agent powered by Claude Sonnet) to assist iterative post-compromise activity across multiple victims while deploying a Linux ESXi-targeting encryptor (encrypt.out, SHA-256 a4af136d...) that enumerates and forcibly kills VMs before encrypting VMDK/VMX and related files; the report details tooling, attack workflow, AD-focused lateral techniques (Nmap, BloodHound, PetitPotam, Certipy), victim leak activity, and multiple IOCs and mitigation recommendations.