Researchers tied to the Aurora ransomware group described a real intrusion that started with aggressive email bombing, then phone calls where attackers posed as the IT help desk to “help” employees fix the issue. Separate reporting shows the same group used the Cursor AI coding assistant to plan and guide hands-on exploitation once they already had credentials or a way into victim networks.
A documented Aurora ransomware intrusion began not with a phishing email but with disruption. Attackers flooded an employee's inbox with an aggressive email bomb, creating a stressful and urgent situation. Shortly after, a phone call followed from someone claiming to be IT help desk staff, offering to help resolve the email flood. That offer of help was the actual attack: following the caller's instructions led to remote access being established using an open-source utility called Xray-core.
Separate reporting from CloudSEK and Gambit Security describes Aurora operators also using the Cursor AI coding assistant once they already had credentials or an existing route into a victim's network. The AI agent was reportedly tasked with hands-on activities including VPN and proxy setup, scanning internal subnets with tools like Nmap or NetExec, domain privilege enumeration, NTLM relay attempts, and certificate-based attacks.
The email bombing created a moment of genuine technical disruption and stress. When a caller then appeared to offer a fix, framed as internal IT support, employees were primed to accept help rather than question it. The pretext exploited the natural instinct to resolve an active problem quickly, and the caller's offer to "fix" the issue provided a plausible reason to follow instructions that led to remote access being enabled.
Once inside, the reported use of an AI coding assistant to guide exploitation suggests attackers were able to move through scanning, enumeration, and privilege escalation steps efficiently after gaining that initial foothold.
Organizations can reduce the risk of this pretext succeeding by reinforcing a few habits across all employees, not just technical staff:
The combination of a disruptive pretext with a helpful sounding follow up call is a pattern that can be rehearsed and recognized. Reinforcing verification habits around unsolicited IT contact remains one of the most direct ways to reduce the chance that this kind of pretext succeeds.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
According to reporting, initial access was achieved via aggressive email bombing followed by phone calls where attackers posed as IT help desk personnel offering to help fix the issue, ultimately establishing remote access using an open-source utility called Xray-core.
Treat the call as suspicious and verify the caller's identity using known internal numbers or your organization's ticketing system before taking any action.
Yes, separate reporting from CloudSEK and Gambit Security indicates Aurora operators used the Cursor AI coding assistant to plan attacks and guide hands-on exploitation once they had credentials or an existing route into a victim network.
Gambit Security observed activity such as VPN/proxy setup, internal network scanning, domain privilege enumeration, NTLM relay attempts, and certificate attacks carried out with the help of an AI coding agent.
Imagine your inbox suddenly explodes with hundreds of emails… and then your phone rings. That’s how the Aurora ransomware gang got in: email bombing first, then a call, “Hi, this is IT help desk, we’re calling to help you deal with the email flood.” They walk you through steps that quietly install remote access, like Xray-core. Here’s the scary part: once Aurora had access, researchers saw them using an AI coding assistant called Cursor to script VPNs, scan internal systems, and hunt for domain privileges. The hard work is automated. If your inbox gets bombed and “IT help desk” calls out of the blue, hang up and call IT back using our official number or ticketing system before you do anything.
Investigators found chat logs showing Russian-speaking criminals repeatedly claiming they were running “legitimate security tests” to get Cursor’s AI agent to help during real intrusions. The logs indicate the AI assisted with tasks like network scanning, privilege enumeration, VPN setup, and…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Levi Strauss disclosed a breach after attackers used social engineering to access three employees’ work computers and steal some corporate data. Separately, reporting and Google’s tracking describe a broader campaign where criminals call employees while posing as coworkers or IT, then send them to…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Researchers found a crypto fraud operation that used AI-assisted tooling to sift and verify over 100,000 phone numbers, then target confirmed crypto users. The campaign used a one-two approach: phishing messages that included a case/verification code, followed by phone calls that referenced those…
A criminal actor calling itself “Ransom Busters” is emailing organizations that recently suffered ransomware incidents, claiming it hacked ransomware groups’ servers and can delete the victim’s stolen data for a $20,000–$60,000 fee. The messages ask to speak with the CEO or IT leadership and…
