https://badtech.org/tag/ransomware/Notes on security, vulnerabilities, and the systems we depend on.en-ushttps://badtech.org/aurora-ransomware-operator-used-cursor-agent-in-10-intrusions-and-targeted-esxi-hosts/https://badtech.org/aurora-ransomware-operator-used-cursor-agent-in-10-intrusions-and-targeted-esxi-hosts/Mon, 31 Aug 2026 14:54:27 +0000Gambit Security says an Aurora ransomware operator used Cursor Agent inside 10 victim networks and paired it with tooling to find and encrypt VMware ESXi environments. According to Gambit Security, the operator used Cursor Agent, running Claude Sonnet, during hands-on activity across 10 organizations between April 8 and May 21, 2026. Gambit said the sessions started with credentials or an existing route into the network, then used the agent for internal scanning, VPN or proxy setup, privilege enumeration, NTLM relay attempts and certificate attacks. Gambit also reported that many agent commands failed on the first try and were sometimes retried with refined prompts or scripts.BreachesRansomware