NEW JERSEY — TECH – An exposed server linked to an affiliate of the Aurora ransomware operation has given cybersecurity researchers an unusually detailed look inside the working environment of a cybercriminal targeting organizations across nine countries.
CloudSEK says the exposed system contained months of attacker activity, including shell history, credentials, victim data, attack tools, ransomware encryptors and AI-assisted planning sessions. Working with blockchain intelligence firm TRM Labs, researchers also traced ransom payments and laundering activity connected to the operation.
The findings matter well beyond the organizations directly affected. For businesses, municipalities, health-care organizations, First Nations, mining companies and other institutions in Northwestern Ontario, the report offers a reminder that modern ransomware attacks increasingly combine stolen credentials, remote access tools, artificial intelligence and attacks on backup infrastructure.
There is no indication in the material released by CloudSEK that a Thunder Bay or Northwestern Ontario organization was among the victims identified.
Researchers Say More Than 20 Organizations Were Compromised
According to CloudSEK, the operator was active in the recovered data between April and July 2026 and compromised more than 20 organizations across nine countries.
Researchers say the attacker achieved domain-level or interactive access at 17 organizations.
Four organizations found in the attacker’s files were later listed on Aurora’s public leak site, providing a connection between activity observed in the exposed server and subsequent public extortion campaigns.
The affected sectors included:
- manufacturing and industrial operations;
- food and agriculture;
- professional and financial services;
- transportation and logistics;
- consumer goods;
- environmental services; and
- IT and backup infrastructure.
CloudSEK says the United States accounted for the largest portion of confirmed victims.
In several cases, researchers found evidence that the attacker had obtained highly privileged access, including domain administrator credentials, VPN credentials, Kerberos authentication material, Group Policy information and credentials connected to backup systems.
Most organizations identified in the recovered data had not appeared on public ransomware leak sites, according to CloudSEK.
The company says it began notifying relevant national computer emergency response teams and affected organizations before publishing its findings.
AI Assistant Allegedly Used to Plan Attacks
One of the most notable findings was the attacker’s use of Cursor, an AI-powered coding assistant.
CloudSEK says recovered sessions showed the operator using the software in Russian to work through attack sequences against enterprise networks.
The conversations reportedly included planning around Active Directory Certificate Services, a Windows enterprise feature that can become a target when improperly configured.
The significance is not simply that an attacker used AI to generate code.
According to CloudSEK, the recovered conversations show AI being used as an active planning tool during real-world attacks, helping the operator reason through different pathways to compromise systems.
That adds another dimension to concerns about how widely available AI tools can be incorporated into criminal cyber operations.
For defenders, it also reinforces an important reality: AI can help attackers move faster, but most ransomware attacks still depend on familiar weaknesses such as exposed credentials, poor network segmentation, vulnerable software and inadequate controls around administrator accounts.
A Repeatable Ransomware Playbook
The exposed server allowed researchers to reconstruct what they describe as a repeatable attack process.
CloudSEK says the operator regularly carried out Active Directory and SMB discovery and retrieved password policies before using credential-attack techniques such as Kerberoasting and AS-REP Roasting.
Those techniques are commonly used to obtain or crack authentication credentials in Microsoft Windows environments.
For privilege escalation, CloudSEK reported seeing several different approaches depending on the victim’s network.
They included:
- a custom noPac exploitation chain;
- abuse of Active Directory Certificate Services;
- NTLM relay attacks;
- PetitPotam;
- PrinterBug; and
- DFSCoerce.
The attacker also stored exploit code for at least a dozen vulnerabilities.
Researchers say much of that code came from publicly available proof-of-concept material, although some tools had been modified.
CloudSEK also found custom NetExec modules designed to collect browser credentials and identify VMware ESXi infrastructure.
The company assesses with high confidence that the individual was operating as a direct Aurora ransomware affiliate rather than simply selling access to other criminals.
According to the investigation, the activity continued from initial compromise into credential theft, domain takeover, data exfiltration, ransomware deployment and extortion.
Windows, Linux and VMware ESXi Systems Targeted
The exposed environment also contained multiple versions of the Aurora ransomware encryptor.
CloudSEK says versions were found for both Windows and Linux/VMware ESXi environments.
The ransomware was written in Zig, a programming language that is relatively uncommon in ransomware development.
Researchers say the Windows and Linux versions appear to have originated from the same codebase and were compiled for different operating systems.
The encryptor supports features intended to make attacks faster or more configurable, including partial-file encryption, multithreading and file-size controls.
The Linux/ESXi variant included functions specifically aimed at virtualized infrastructure.
Before encryption, CloudSEK says the ransomware could enumerate running virtual machines and forcibly shut them down.
It could also alter an ESXi host’s SSH login banner so the ransom message appeared when administrators logged into the server.
That capability is particularly concerning for organizations that rely heavily on virtualization.
A successful attack against an ESXi environment can potentially disrupt numerous virtual servers simultaneously rather than compromising only one workstation or server.
Why Backup Systems Are a Critical Target
One detail in the CloudSEK report should stand out to local IT managers: the attacker was actively seeking access to backup infrastructure.
Ransomware operators frequently attempt to compromise or delete backups before encrypting production systems.
That can eliminate one of an organization’s most effective recovery options and increase pressure to pay a ransom.
For organizations in Northwestern Ontario, where specialized IT resources can be limited or geographically distant, losing both production data and backups at the same time can create a serious operational crisis.
This is especially relevant to:
- municipalities;
- First Nations governments;
- health-care organizations;
- schools and educational institutions;
- mining and forestry companies;
- transportation firms;
- utilities;
- professional offices; and
- managed IT service providers.
Offline, immutable or otherwise isolated backups remain an important defence because they are harder for an attacker who has gained domain administrator privileges to destroy.
Researchers Follow Ransom Payments on the Blockchain
The exposed server also provided insight into what happened after victims paid.
CloudSEK says a cryptocurrency wallet provided by the operator held seven Bitcoin at the time researchers examined it.
Working with TRM Labs, researchers traced a confirmed ransom payment through the blockchain.
TRM Labs’ wider analysis reportedly identified two confirmed victim payments and two additional transactions consistent with payments from separate victims.
Although the payments initially followed different paths, several later converged through shared consolidation points before moving toward infrastructure that researchers believe was used for cashing out the funds.
The investigation found different apparent revenue splits across transactions, including 35/65, 21/79, 46/54 and 40/60.
Researchers said there was no single consistent percentage split across the payments examined.
One payment followed a different laundering route using what cryptocurrency investigators call a peeling chain, in which portions of cryptocurrency are moved through a series of transactions.
The findings suggest the number of organizations that paid Aurora-linked operators may be greater than the number publicly identified on ransomware leak sites.
Russian-Language Material Found, but Nationality Not Established
CloudSEK assesses with high confidence that the operator was Russian-speaking.
Researchers based that assessment on material created by the attacker, including AI conversations, module documentation and working notes written in Russian.
They also reported finding no Commonwealth of Independent States-allocated IP ranges or CIS-country domains in three months of target lists and attack logs.
That pattern is notable because some ransomware groups historically avoid targeting organizations in Russia or neighbouring states.
CloudSEK cautions, however, that language and targeting behaviour do not establish the attacker’s nationality or physical location.
That distinction is important.
Cybercrime attribution is difficult, and evidence that a person communicates in Russian does not prove they are operating from Russia or are associated with the Russian government.
Why This Matters to Thunder Bay and Northwestern Ontario
For organizations in Northwestern Ontario, the CloudSEK findings are useful because they show how a ransomware attack can develop long before an encryption screen appears.
By the time ransomware is deployed, an attacker may already have:
- stolen usernames and passwords;
- gained administrator privileges;
- explored network shares;
- identified backup systems;
- located virtual infrastructure;
- copied sensitive information; and
- prepared an extortion strategy.
That makes ransomware prevention as much an identity and access-management problem as a malware problem.
Organizations cannot rely solely on antivirus software.
Multi-factor authentication, rapid security patching, administrator-account controls, network segmentation, secure backups and monitoring for unusual authentication behaviour all become critical.
This is particularly important for remote and northern organizations where systems may connect multiple communities, sites or industrial operations across long distances.
A cyberattack that disables a southern Ontario corporate office is serious.
A cyberattack that disrupts communications, payroll, medical systems, transportation scheduling or essential services in a remote community can have much broader consequences.
AI Raises the Speed of the Cybersecurity Race
The use of an AI coding assistant in this operation also illustrates an emerging challenge for cybersecurity teams.
Artificial intelligence does not eliminate the need for technical skill, but it can lower barriers and accelerate research, troubleshooting and attack planning.
The same is true for defenders.
AI-assisted security tools can help analyze logs, identify unusual activity and respond more quickly to incidents.
The emerging contest is therefore not simply attackers using AI against organizations that do not.
It is increasingly a race between organizations capable of detecting and responding quickly and attackers using automation and AI to move through compromised networks faster.
What Organizations Should Take From the Report
The most important lesson from the exposed Aurora server is that ransomware is a process, not a single piece of malicious software.
The encryption stage is often the end of an intrusion that may have been underway for days or weeks.
Organizations can reduce their exposure by focusing on several basic controls:
- require multi-factor authentication for remote and administrative access;
- patch internet-facing systems quickly;
- restrict and monitor administrator accounts;
- protect backup credentials separately from regular network accounts;
- maintain offline or immutable backups;
- segment critical servers and virtual infrastructure;
- monitor for suspicious authentication behaviour;
- remove unused services and accounts; and
- maintain an incident-response plan before an attack occurs.
CloudSEK says its full report includes technical indicators of compromise, malware hashes, attacker infrastructure information, detection rules and mitigation guidance.
For technology leaders in Thunder Bay and across Northwestern Ontario, the report provides a rare look at ransomware from the attacker’s side of the keyboard.
The bigger takeaway is straightforward: modern ransomware operators are organized, adaptive and increasingly willing to use AI alongside traditional intrusion tools.
The strongest defence is making sure attackers do not get the time and unrestricted access they need to reach the encryption stage.
Summary: Exposed Aurora ransomware server reveals AI-assisted attacks, stolen credentials and crypto laundering.
