Aurora Ransomware: AI-Assisted Attacks Exposed

**Aurora ransomware** activity (Apr–Jul 2026) targeted more than 20 organizations across nine countries; CloudSEK’s investigation recovered operator materials, Active Directory artifacts, Windows and Linux/ESXi encryptors, IoCs (file hashes and VPS IPs), and Cursor AI-assisted planning notes for ADCS exploitation, concluding the attacks were human-led but leveraged AI as a planning aid while emphasizing identity, ADCS and backup hardening.