Gambit Security Exposes Aurora’s AI-Assisted ESXi Ransomware Operations

Key Takeaways

• Gambit Security found Aurora ransomware infrastructure and a Linux encryptor designed to disable and encrypt VMware ESXi virtual machines.
• An Aurora operator used Cursor Agent running Claude Sonnet to support hands-on exploitation across ten organizations between April 8 and May 21, 2026.
• A second cluster, attributed to an Aurora operator with medium confidence, used separate infrastructure and techniques to steal data from eight organizations.

Gambit Security has uncovered infrastructure associated with the Aurora ransomware group, revealing an operation that combines VMware ESXi encryption, data theft and AI-assisted intrusion activity. Aurora has reportedly operated since approximately April 2026, maintaining a data leak site and targeting victims in multiple countries.

The investigation's most consequential finding is a Linux ransomware variant built to attack virtualized environments. Hosted on Cloudflare R2 and manually copied to several internal systems, the 139 KB ELF sample, named encrypt.out, encrypts files in place using ChaCha20. It protects each session key with an embedded RSA-4096 public key.

Its command-line controls give an operator considerable flexibility. Aurora can select a path, limit processed file sizes, configure scanner and worker threads, choose partial encryption percentages and invoke a dedicated ESXi mode. Partial encryption can reduce processing time when attackers are dealing with large virtual disks, allowing disruption to spread more quickly.

In ESXi mode, the malware runs native esxcli commands to identify each running virtual machine and collect its World ID. It then forcefully terminates the guests, releasing locks on their virtual disk files. The encryptor targets VMDK, VMX, VMSD, VMSN, NVRAM, VMEM, VSWP and log files while skipping BOOTBANK and OSDATA system volumes.

By leaving the underlying hypervisor bootable, Aurora can keep the compromised host accessible while making its guest workloads unusable. The malware also writes its extortion message into /etc/ssh/sshd-banner, presenting the demand to administrators before the SSH login prompt.

Compromising a single virtualization host allows attackers to interrupt dozens of guest servers simultaneously. Hypervisors accounted for 25% of observed encryption events by the second half of 2025, according to Huntress data, highlighting a rapid pivot toward virtualization-layer ransomware. That concentration of risk makes VMware ESXi and vCenter Server attractive targets. The ENISA threat landscape identifies ransomware as a leading European cyber threat and notes growing attacker interest in cloud and virtualization layers. Arete has likewise documented crimeware activity affecting enterprise infrastructure.

Aurora appears to have built supporting reconnaissance for that purpose. Researchers identified esxi_finder.py, a custom NetExec LDAP module used to locate VMware ESXi hypervisors and vCenter Server instances. The module discovers internal subnets through domain-controller queries or operator-supplied ranges, scans ports 443 and 902, examines TLS certificates and requests common VMware paths to identify products and exact builds.

The human operator also delegated portions of the intrusion workflow to Cursor Agent running claude-4.5-sonnet-thinking. Between April 8 and May 21, 2026, the team observed Agent sessions involving ten target organizations. The operator supplied credentials or network access, then requested actions ranging from privilege enumeration to internal scanning.

Tasks included configuring VPN clients and proxychains, scanning with Nmap or NetExec, collecting BloodHound data, attempting NTLM relay attacks and running certificate-focused attacks with Certipy. The Agent often failed on its first attempt, then revised commands or scripts. Some tasks eventually worked; others produced only reports of unsuccessful attempts. The finding shows iteration and workflow acceleration rather than autonomous compromise.

The operator imposed repeatable guardrails: no DCSync, no account lockouts and no creation of computer objects in Active Directory. Those restrictions suggest an effort to reduce conspicuous changes and preserve access. By contrast, a second cluster attributed to Aurora with medium confidence did use DCSync, alongside exposed SQL Server xp_cmdshell, GodPotato privilege escalation and s5cmd transfers to self-hosted S3-compatible storage.

Gambit Security connected that second cluster to Aurora after data stored on its exfiltration infrastructure appeared on Aurora's leak site nine days later. The cluster affected eight organizations across Israel, Germany, Austria, Spain, the United States and Argentina. Similar ESXi targeting is already established elsewhere: ManageEngine documents Akira techniques and indicators associated with attacks on VMware environments. For defenders, Aurora adds another reason to isolate hypervisor management interfaces, restrict SSH and esxcli access, monitor forced VM shutdowns, patch VMware products promptly and keep recovery copies beyond the reach of compromised administrative credentials.