Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
Summary: Researchers at CloudSEK and Gambit Security found that operators of Aurora ransomware used SpaceX's Cursor coding assistant, running Anthropic's Claude Sonnet, to plan and carry out exploitation against 10 targets between April 8 and May 21, 2026. An exposed directory leaked months of activity against more than 20 organizations in nine countries from April to July 2026, and the group's Windows and Linux/ESXi encryptors were built from a single Zig codebase.
Bottom line: The operator's recovered chat history includes a full Active Directory Certificate Services exploitation plan written in Russian, and in some cases the attacker's only input was replying with a number to pick the agent's next step - meaning the tooling that once required a skilled intruder can now be driven by someone choosing from a menu.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026