Aurora, also written Aur0ra, is a Russian-speaking ransomware-as-a-service operation. Per CloudSEK, it targeted more than 20 organisations across nine countries between April and July 2026. Four appear on its leak site. Gambit Security separately documented 10 targets between 8 April and 21 May.

What makes it worth writing about is how the operators worked.

The targeting rule lives in a prompt now

Aurora used Cursor, an AI coding assistant, to plan attacks in Russian — and instructed it to exclude CIS address ranges and CIS-country domains.

Read that as an operational document. Avoiding targets in the Commonwealth of Independent States is the oldest rule in Russian-speaking cybercrime, because prosecution follows victims at home and does not follow victims abroad. It has historically been implemented in code: a keyboard-layout check, a locale check, a hardcoded list of country codes that makes the ransomware exit quietly.

The rule did not change; its medium did — from a compiled check a reverse engineer can find in the binary, to a sentence typed to an assistant in a chat log nobody outside ever sees. For 10 years the CIS check has been one of ransomware analysis's most reliable classification signals, and it is now moving out of the artefact.

That is a quiet loss for defenders, and not one that shows up in a detection rule.

What they had it do

The agent was tasked with network scanning, domain enumeration, NTLM relay attempts, certificate attacks and planning Active Directory Certificate Services exploitation. None of that is novel tradecraft. What the assistant changes is the floor: an affiliate who could not previously chain those steps together now can, because the planning has been delegated.

AD CS abuse is well documented — CISA's red team used the same class of misconfiguration against a government organisation this month.

The pattern matches the command-and-control framework with a natural-language front end that sells for $99.99. The capability is not new. The number of people who can operate it is.

Reuters has named victims including Christeyns, Teckentrup, the Helideck Certification Agency and Bayou Title, alongside an Argentine pharmaceutical distributor and an Italian manufacturer.

A correction you are going to need

Widely-syndicated coverage of this story describes Cursor as SpaceX's AI-powered coding assistant. It is not: Cursor is made by Anysphere, the company named throughout Cursor's own terms of service. SpaceX appears on cursor.com as a customer, on the logo wall, which is almost certainly where the error came from.

A separate summary of the same article offered a third answer, Anthropic, which is also wrong. Two independent descriptions of one fact, both incorrect, on a detail anyone can verify in thirty seconds.

We checked before writing, because that sentence is about to be copied into a lot of articles, and a ransomware story that misattributes the tool to a rocket company is the kind of error that outlives the reporting.

What to do

  • Do not treat CIS exclusion as a reliable classifier any more. If the check has moved into the planning stage, it may not appear in the sample at all.
  • Prioritise AD CS. Misconfigured certificate templates are among the most reliably abused paths into a domain, and they are fixable.
  • Assume the floor has dropped. Defences calibrated to what an unsophisticated affiliate could previously manage are calibrated to the wrong thing.
  • Watch for NTLM relay and disable NTLM where you can.

What is not established

  • How Cursor was obtained or accessed, or whether any terms were circumvented.
  • Whether the AI planning materially improved outcomes, as distinct from being used.
  • Which sectors were targeted. Not stated.
  • Why the CloudSEK and Gambit Security counts differ — different windows and methodologies, but the overlap is not described.
  • Any response from Anysphere. None reported.