#cloudsek

2 articles

The ransomware affiliate ran his commands through an AI assistant's tool protocol, then scanned the internet for more of them

2026-10-08Security

CloudSEK documents a Gentlemen ransomware affiliate who wired Model Context Protocol into his attack chain as an execution channel, reached every victim through stolen CI/CD secrets, and published the proceeds on his own leak site rather than the gang's. The investigation started with an open directory he left unauthenticated.

The ransomware crew wrote its targeting rule into a prompt: plan the attack, skip anything in the CIS

2026-09-01Security

Aurora used the AI coding assistant Cursor to plan intrusions in Russian — AD CS exploitation, NTLM relay, domain enumeration — while instructing it to exclude CIS address ranges and domains. More than 20 organisations across nine countries between April and July. Also: Cursor is made by Anysphere, not SpaceX, whatever you are about to read elsewhere.