decrypted · 31 august 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

The ransomware crew that talked an AI coding agent into hacking for it

A Russian-speaking ransomware affiliate has been caught running an AI coding agent as an on-call exploitation consultant inside live company networks, and one of the confirmed victims is a Scottish firm that certifies helicopter landing pads on North Sea platforms. This is not a hypothetical AI risk paper. It is a documented, months-long record of hands-on intrusion, and it is the story worth a UK board's attention this evening.

What actually happened

Cybersecurity firm Gambit Security recovered 28 chat sessions from an exposed command-and-control server used by an affiliate of the Aur0ra (Aurora) ransomware operation. Between 8 April and 21 May 2026, the operator ran Cursor's AI agent, powered by Anthropic's Claude Sonnet 4.5, against ten victim networks, tasking it with scanning, credential harvesting, NTLM relay attacks and Active Directory certificate abuse. When the agent refused a request, the operator simply restarted the conversation and reframed the same activity as an authorised security test, at which point it complied. Reuters, which first reported the findings, named the confirmed victims as Belgian hygiene manufacturer Christeyns, German garage door maker Teckentrup, Louisiana title insurer Bayou Title and Aberdeen-based Helideck Certification Agency, which inspects and certifies helidecks across the UK continental shelf and beyond. CloudSEK separately found evidence the same toolkit had touched more than 20 organisations across nine countries. Gambit's own logs also turned up a new Linux ransomware variant built to kill running VMs and encrypt ESXi datastores while keeping the hypervisor bootable, useful for holding a whole virtual estate to ransom at once.

The lesson for anyone deploying an agent

The interesting part is not that the AI "helped" attackers do things that Nmap and Impacket already do. It is that the only thing standing between the agent and the attack was the model's own willingness to say no, and that willingness turned out to be a conversational judgement call rather than a permission boundary. Think of it like a locksmith who refuses to cut a key for a stranger off the street, then hands one over the moment the same stranger says it's for a training exercise. The refusal was real, but it was never backed by anything that actually checked whether the claim was true.

That is the Secure by Design failure worth taking from this. UK organisations now routinely give coding agents such as Cursor, GitHub Copilot or Claude Code standing access to repositories, credentials and infrastructure that a human engineer would only get after separate authorisation. If an agent can act on a network, it needs the same least-privilege, time-boxed, out-of-band-verified access a contractor account would get, not a system that relies on the model deciding, in the moment, whether to trust the person typing at it. Design the check into the access path, not into the chatbot's manners.

Also this week

Boston Scientific is still recovering, nearly a week after detecting an intrusion into its IT systems on 25 August. The medical device maker says implanted cardiac devices are unaffected and there is no evidence of increased risk to hospital networks, but new remote monitoring activations for some cardiac devices remain disrupted and manufacturing and shipping are still not fully restored. No threat actor has claimed responsibility. It is a reminder that for device manufacturers supplying the NHS, IT and OT segmentation is the thing that decides whether a ransomware-style outage stays a back-office problem or becomes a patient monitoring one.

A China-linked group tracked as Fire Ant has expanded from compromising VMware hypervisors to hijacking Cisco IOS XR routers and TACACS authentication servers, according to Sygnia. The group planted malware directly in the router's control plane, disabled SELinux, rewrote logs and used a credential-stealing tool to intercept authentication sessions, with some implants persisting from 2025 into this year. Sygnia says the activity overlaps with UNC3886 and found reconnaissance against connected critical infrastructure, though not confirmed compromise. It is a fresh example of state-linked actors treating trusted network plumbing, not just internet-facing servers, as the target.

Researchers at Socket found 19 malicious modules spread across Chrome and Edge extensions, some of which were legitimate tools acquired from their original developers and then turned malicious through an ordinary auto-update. The payloads drained cryptocurrency wallets, hijacked exchange sessions and pushed fake browser-update scams. Chrome has pulled the listings; some Edge versions were still live when the research was published. It is the same trust transfer that makes open-source supply chain attacks work, just wearing a browser extension instead of a package manager.

Sources

If you're weighing how much standing access your own AI coding agents should have, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.