esxi_finder.py

Aurora operators drove Cursor Agent through ten victim networks over six weeks

Gambit Security says the ransomware crew used a commercial coding agent for hands-on post-compromise work between 8 April and 21 May, alongside a new Linux encryptor that force-kills running guests before it touches ESXi datastores.