Researchers document Cursor-assisted Aurora ransomware intrusions
Gambit Security and CloudSEK published evidence that a Russian-speaking Aurora ransomware affiliate used Cursor Agent during intrusions from April through July. The researchers describe credentialed reconnaissance, VPN and proxy setup, domain enumeration, NTLM relay and certificate attacks; Reuters reviewed underlying data and identified six victims, while reporting at least seven companies were breached with AI assistance.
Why it matters: It is concrete evidence of a general coding agent being used inside an interactive intrusion workflow. Existing credentials, routes, model output, identity, and administrative tools formed one attack system rather than a standalone malicious prompt.