Aurora Ransomware Deployed Cursor AI Coding Agent for Autonomous Network Exploitation
A threat intelligence report from Gambit Security has revealed that the Russian-speaking ransomware operation known as Aur0ra (Aurora) utilized the Cursor AI coding assistant to conduct hands-on network intrusions and automated exploitation across at least seven enterprise environments between April and May 2026. According to session logs recovered from exposed threat actor infrastructure, the attacker drove Cursor Agent configured with the claude-4.5-sonnet-thinking model identifier to execute
1 min