Russian-speaking Aurora ransomware group used the AI coding assistant Cursor to help breach corporate networks in multiple countries
Researchers at Gambit Security and CloudSEK found the Aurora ransomware group used Cursor's AI coding agent to scan networks, steal credentials and break into at least 10 corporate networks, per The Hacker News, Cybernews and Reuters.
Security researchers at Gambit Security and CloudSEK say the Russian-speaking Aurora (Aur0ra) ransomware group used Cursor, an AI coding assistant running Claude Sonnet 4.5, to help carry out hands-on exploitation inside at least 10 corporate networks between April 8 and May 21, 2026. A separate CloudSEK analysis traced the group's activity to more than 20 organizations across 9 countries between April and July 2026. Gambit's Eyal Sela said AI assistance made the attackers roughly 30-50% faster, and that the hackers bypassed Cursor's safety guardrails by repeatedly claiming the intrusions were authorized security tests. Reuters independently identified victims including Belgian cleaning-products manufacturer Christeyns, German garage-door maker Teckentrup, Scotland's Helideck Certification Agency and Louisiana's Bayou Title. Aurora's own leak site currently lists 31 victims. Sources: The Hacker News, Cybernews, Reuters.