Executive Summary
CloudSEK and Gambit Security found Aurora ransomware operators using the Cursor AI coding assistant to break into about 10 target networks.
What Happened
Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its
Affected Products
- Cursor
Vulnerability / Attack Technique
AI coding assistant used in intrusions
Technical Mechanism
As reported, the assistant supported attack tooling and operations.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
Ransomware crews use mainstream AI coding tools. RealGround analysis: faster tooling means shorter dwell before encryption.
Recommended Controls
- Shorten detection and response times
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.