CERT24Aurora ransomware operators used an AI agent to conduct cyberattacksLoading data…
CERT24Threat Observatory
Period

Aurora ransomware operators used an AI agent to conduct cyberattacks

Threat actors associated with the Aurora, or Aur0ra, ransomware used the Cursor AI coding assistant to plan and conduct attacks. CloudSEK and Gambit Security described activity involving access to target networks, lateral movement, data theft and exfiltration, and deployment of an encryptor. The source also describes a separate AI-assisted toolkit called Gryxa.

← Back to intelligence

Aurora ransomware operators used an AI agent to conduct cyberattacks

Threat actors associated with the Aurora, or Aur0ra, ransomware used the Cursor AI coding assistant to plan and conduct attacks. CloudSEK and Gambit Security described activity involving access to target networks, lateral movement, data theft and exfiltration, and deployment of an encryptor. The source also describes a separate AI-assisted toolkit called Gryxa.