Aurora (aka Aur0ra) ransomware operators, a Russian-speaking group, are using SpaceX’s Cursor AI assistant (running Claude Sonnet) to plan and execute intrusions, excluding CIS targets. Leaked infrastructure exposed months of activity against over twenty (20) organizations and revealed Windows and Linux/ESXi encryptors written in Zig, capable of killing VMs, deleting shadow copies, and disabling System Restore and Defender. Aurora uses phishing, phone-based social engineering, and lateral movement across common Windows protocols, then exfiltrates data and encrypts systems. Current structures found through research show that affiliates receive 54–79% of ransoms. Separately, another threat actor built the Gryxa toolkit with AI to turn legitimate RMM tools into covert access, persist via scheduled tasks, steal browser credentials and crypto wallets, disable security tools, and log defenders’ remediation efforts. CTIX Analysts will continue to report on the most recent threat actor activities and emerging campaigns.