On 27 August 2026, CloudSEK published “The Aurora Files”: an exposed affiliate server from the Aurora ransomware operation leaked the operator’s tooling, command history, stolen credentials and, most striking, chat logs with the AI coding assistant Cursor. A Russian-speaking affiliate used the agentic assistant to plan intrusions and Active Directory escalation, compromising 20+ organizations across nine countries between April and July 2026. Manufacturing, food, agriculture and professional-services firms were hit — exactly the SME profile common across Cyprus.
Why this matters for a business in Cyprus
Many Cyprus companies run a lean IT team and a single Active Directory domain, often with a Certificate Services role nobody has audited. That is precisely what Aurora’s operator went after. The assistant worked through an AD CS exploitation plan — the ESC chains that turn a weak certificate template into Domain Admin. AI lowers the attacker’s skill floor and speeds them up, so a mid-tier intruder now moves like a specialist and your window to react is shorter. Under GDPR and NIS2, a domain-wide ransomware event is also a reportable data breach with real fines attached.
How to get ahead of AI-driven ransomware
- Audit AD CS for ESC1–ESC8. Requester-supplied SAN templates, HTTP web-enrollment, NTLM relay to the CA, over-broad enrollment rights — these are the first things an assistant finds.
- Tier your admin access. No Domain Admins on workstations, LAPS everywhere, Tier 0/1/2 separation. This breaks the path from first host to domain controller.
- Shrink the perimeter. Know what faces the internet, and monitor certificate issuance and Kerberos anomalies to catch escalation in the act.
- Govern your own AI assistants. Your developers run the same agentic tools with broad access, so treat them as a new attack surface, not just a productivity boost.
How we help
Aurora shows both offense and defense moving into the agentic world. For companies in Cyprus we map the exposed perimeter with external network penetration testing, pressure-test the domain (including AD CS/ESC) with Active Directory penetration testing, prove the real blast radius with an assumed-breach assessment, and govern the assistants your own team runs with agentic-AI threat modeling. Get a fixed-price quote and we’ll find the weak link before an attacker’s AI does.
Related service: ransomware readiness assessment — attack-path simulation, backup isolation and detection validation against real ransomware TTPs.
Source: CloudSEK, “Caught in 4K: The Aurora Files” (27 August 2026); additional reporting by CybersecurityNews, GBHackers, OODAloop.