Aurora Ransomware Uses Cursor AI to Attack 10 Targets in First Use of AI Coding Infrastructure

The ransomware group provided the agent with credentials or existing network routes to conduct exploitation tasks across multiple victim networks. Aurora operators used the Cursor AI coding assistant to perform network scanning, privilege checks, NTLM relay attempts, and certificate attacks against 10 confirmed targets.

The activity establishes AI coding assistants as documented attack infrastructure. Researchers found chat logs on a server belonging to a Russian-speaking affiliate who used the tool to plan attacks on more than 20 organizations, while analysts warn that firms without AI tool audits are blind to the threat.