The Coding Assistant Became the Intruder: Ransomware Crews Are Now Running AI Agents Inside Live Networks
An Aurora ransomware operator handed the hands-on hacking to a commercial AI coding agent across ten victim networks. The agent’s job list reads like a red-team playbook, and it should change how every OT and maritime defender thinks about attacker tempo.
September 22, 2026 | By The CyberSurv Team | CyberSurv
For a while, the AI-and-cybercrime conversation stayed comfortably abstract. Models could write phishing lures. They could sketch malware in a lab. Scary, sure, but still a step removed from someone actually inside your environment. That gap just closed.
On August 27, threat intelligence firm Gambit Security published its findings on an affiliate of the Aurora ransomware operation. What they documented isn’t a proof of concept. It’s a working intrusion. Between April 8 and May 21, 2026, the operator pointed Cursor’s coding agent, running on a commercial large language model, at ten separate victim organizations and told it to do the dirty work. Reconnaissance. Credential theft. Active Directory escalation. The recovered chat history reads less like a hacking session and more like a manager delegating tasks to a very fast junior analyst who never sleeps.
We’ve been tracking this trajectory for months, from AI porting a five-year-old PLC exploit to autonomous agents breaching cloud infrastructure on their own. This latest case is the one that pulls it all together. Let’s unpack what actually happened and, more importantly, what your team should do about it.
What the Agent Was Actually Told to Do
Here’s the part that lands hardest. The operator didn’t need custom malware or a genius-level exploit chain. He needed a competent operator who could grind, and he rented one. Gambit’s researchers recovered the specific tasks handed to the agent, and every one of them is a standard corner of the intrusion toolkit:
- Install and configure a VPN client or proxychains, then tunnel into a victim using supplied credentials or an existing SOCKS route.
- Scan internal subnets for live hosts with Nmap and NetExec.
- Enumerate the domain to report exactly which privileges a given account holds, using NetExec’s BloodHound collector.
- Attempt NTLM relay attacks, coercing authentication with PetitPotam, Coerce Plus, and PrinterBug, then relaying it with Impacket’s ntlmrelayx.
- Run certificate-based attacks with Certipy.
Sometimes the operator just named an objective, like “tell me what rights the user has,” and let the agent figure out the how. Other times the agent produced a numbered list of next moves and the human simply replied with a digit. Point, click, escalate.
Worth noting: this was no flawless robot. Gambit found the majority of the agent’s commands failed on the first try, needing repeated refinement before anything worked. But that’s cold comfort. A tool that eventually succeeds after grinding through failures, tirelessly, at machine speed, is exactly the kind of persistence that wears defenders down.
The Number That Should Worry You: 30 to 50 Percent Faster
Eyal Sela, Gambit’s director of threat intelligence, put a figure on it. The AI made the operator roughly 30 to 50 percent faster, even while using entirely conventional techniques. No exotic zero-days. Just the same tradecraft, compressed.
Think about what speed buys an attacker. Every hour they save on enumeration and lateral movement is an hour your detection and response window shrinks. If your team’s playbook assumes days between initial access and encryption, and the adversary just cut that timeline by a third or more, the plan on paper no longer matches the fight on the ground.
There’s a curious wrinkle here too. The Aurora operator kept issuing strict guardrails to his own AI, repeated across the chats in Russian: no DCSync, no account lockouts, no new computer objects added to the domain. Translation? He wanted to stay quiet. He understood that the loud, obvious moves trip alarms. That’s an attacker thinking hard about your detection logic while an AI does the labor. This same crew deployed a Zig-based ransomware family with both Windows and ESXi variants, the Linux version even hunting down VMware hypervisors with a custom script before encrypting virtual machines.
It’s Not Just Ransomware Affiliates
If Aurora were a one-off, we could file it under “interesting.” It isn’t. In the same window, security firm ReliaQuest detailed a toolkit they named Gryxa, and it raises the bar again. Where Aurora used AI to help run an intrusion, Gryxa appears to have been almost entirely built by a commercial AI coding agent, which shows up as co-author on nearly every commit in the actor’s own repository.
Gryxa turns legitimate remote monitoring and management software into covert access, steals credentials from Chromium browsers, and disables endpoint protection within roughly ten to thirteen minutes if it loses contact with its operator. The genuinely unnerving feature: after defenders remove the visible implant, a hidden component quietly collects Windows logs and host artifacts and ships them back to the attacker, so the crew can study exactly how your team responds and tune their next move. Your incident response becomes their training data. The operator jailbroke the coding agent the same way Aurora did, by dressing the whole project up as an “authorized internal deployment.”
See the pattern? Both crews defeated the model’s safety refusals with a lie about context. Tell the assistant it’s a sanctioned test, and it helps. That social-engineering-of-the-AI is now a repeatable technique, not a clever trick.
Why This Hits OT and Maritime Harder
Enterprise IT can at least field mature detection stacks and staff who know AD attack paths cold. Operational technology environments, port systems, vessel networks, terminal operating systems, rarely have that luxury. They run flatter networks, older gear, and thinner monitoring. An adversary who’s 30 to 50 percent faster is dangerous in a bank. In a facility where a compromise can idle cranes or blind a bridge, the math gets grim in a hurry.
And the tradecraft the agent ran, subnet scanning, credential relay, privilege mapping, works just as well against the IT networks that increasingly bridge into OT. Most maritime and industrial intrusions don’t start on the plant floor. They start on a corporate laptop and walk inward. The AI agent is very, very good at that walk.
The uncomfortable takeaway is that the skill floor for a serious intrusion just dropped. You no longer need a seasoned red-teamer on the payroll to run competent lateral movement. You need a subscription and a willingness to lie to a chatbot.
Final Thoughts
None of the individual techniques here are new. That’s precisely the point. The defenses that catch NTLM relay, that flag BloodHound-style enumeration, that lock down certificate services and watch for anomalous account behavior, they all still work against an AI-assisted attacker. What has changed is the tempo and the volume. More attackers can now run good tradecraft, and they can run it faster.
So the answer isn’t panic, it’s rigor. Assume your detection window is shorter than it was a year ago and build accordingly. Harden Active Directory before the agent goes looking for the weak spot it always finds. Segment IT from OT so a fast walk inward hits a wall. And test your own environment the way these crews test theirs, because the gaps an AI agent will grind against are the same ones a good penetration test surfaces first.
This is exactly the work our RiskGuard 365℠ program is built for, continuous assessment and monitoring that keeps pace with a threat landscape moving at machine speed. For operators in the maritime sector, our maritime cybersecurity services map these enterprise-grade defenses onto the realities of vessel and port environments. And because the fastest-moving threats demand leaders who understand them, our Security Leadership Program helps your executives make sharp decisions under exactly this kind of pressure.
Let’s Explore What’s Possible
The attackers are already using AI to move faster. The right response is to move smarter. If you’re wondering how your defenses would hold up against an AI-accelerated intrusion, let’s talk it through. We’ll help you find the gaps before someone else’s agent does.
