#ParsedReport #CompletenessMedium
31-08-2026

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation

https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation

Report completeness: Medium

Actors/Campaigns:
Aurora_ransomware

Threats:
Aurora_ransomware
Netexec_tool
Proxychains_tool
Nmap_tool
Bloodhound_tool
Petitpotam_vuln
Printerbug_tool
Impacket_tool
Ntlmrelayx_tool
Certipy_tool
Dcsync_technique
S5cmd_tool
Godpotato_tool

Victims:
Organizations, Vmware esxi environments

Geo:
Israel, United states, Argentina, Spain, Germany, Austria

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1003.006, T1018, T1046, T1068, T1069.002, T1078, T1090, T1105, T1110.001, T1110.003, have more...

IOCs:
Url: 2
IP: 21
Domain: 2
Hash: 1
Email: 0
BrowserExtension: 0

Soft:
ESXi, Linux, Claude, Cloudflare R2, esxcli, tor browser

Algorithms:
chacha20, rsa-4096, sha256, md5