Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets Ravie LakshmananAug 31, 2026Artificial Intelligence / Ransomware Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its toolkit, shell history, and encryptor. CloudSEK said the exposed open directory leaked "months of activity" that was active against more than 20 organizations across nine countries between April and July 2026. Four of those victims have since been listed on its data leak site. "The operator used Cursor, an…