Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.
68
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 28, 2026
- Last mentionedAug 31, 2026
Timeline
2 articles · newest firstThreat Actors Abuse Cursor Agent AI to Assist Ransomware Operations
Aurora ransomware operators are using SpaceX-owned Cursor's AI agent to perform reconnaissance and exploitation tasks during intrusions.
55
Appears with
- Cursorvendor · 2
- Claude Sonnetai model · 1
- Gambit Securityvendor · 1
- CloudSEKvendor · 1
- Bayou Titlevictim · 1
- Ransomware.Liveorganization · 1
- Teckentrupvictim · 1
- Claude Sonnetproduct · 1
- Black Hills Information Securityvendor · 1
- Anthropicvendor · 1
- Microsoft Defenderproduct · 1
- VMware ESXiproduct · 1
- SpaceXorganization · 1
- Xray-coreproduct · 1
- vCenterproduct · 1
- Cursorproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.