Aurora Ransomware Group Utilizes Cursor AI Agents for VMware ESXi Exploitation
The Aurora (Aur0ra) ransomware collective has evolved its operational tradecraft by deploying autonomous AI agents via the Cursor AI coding assistant and Anthropic’s Claude Sonnet LLM directly into victim environments. This shift enables real-time, agentic adaptation for reconnaissance and lateral movement, specifically targeting VMware ESXi virtualization layers to maximize operational disruption. By offloading complex exploitation logic to an AI agent within the network perimeter, the group accelerates the compromise of hypervisors, bypassing static detection mechanisms and increasing the velocity of large-scale ransomware deployments across enterprise networks.
Rhysida, Interlock, and The Gentlemen: Modular Supply Chain Targeting VMware ESXi
Rhysida and Interlock ransomware operations have shifted to a modular supply chain model, leveraging Initial Access Brokers (IABs) and specialized crypter services to target VMware ESXi hypervisors. By employing the "GentleKiller" framework—an EDR-terminating toolset targeting over 400 security processes across 48 products—affiliates (including Storm-2697) disable guest-level defenses before deploying Go-based, self-propagating encryptors. This strategy enables the mass encryption of multiple virtual machines simultaneously at the virtualization layer, utilizing per-file ephemeral key encryption to maximize operational paralysis and extortion leverage.