Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora Ransomware Hackers Use Cursor AI Agent for Hands-On Exploitation and ESXi Attacks

Aurora ransomware operators have been observed using Cursor Agent, powered by Claude Sonnet, to support hands-on intrusion activity across ten victim organizations, while deploying a purpose-built Linux encryptor designed to disrupt VMware ESXi environments. The findings show how ransomware affiliates are integrating agentic AI into established post-compromise workflows rather than relying on it as a

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its

AI Agent In Cursor Linked To Ransomware Breaches At 7 Companies | #ransomware | #cybercrime - National Cyber Security Consulting

A Russian-speaking ransomware operator used Cursor’s built-in AI coding agent to help breach at least seven companies across three continents, according to an investigation by Israeli cybersecurity firm Gambit Security first reported by Reuters on Aug. 27. The breaches took place between April 8 and May 21, when an affiliate of the Aur0ra ransomware group […] Thank you for subscribing to our RSS feed! The post AI Agent In Cursor Linked To Ransom…