Aurora Ransomware Affiliate Deploys Cursor AI to Plan Attacks on 20 Organizations for 50% Speed Boost

A Russian-speaking hacker group targeted VMware ESXi systems by employing the Cursor AI coding assistant to automate malicious operations. Researchers discovered chat logs and encryptor binaries on the Aurora ransomware affiliate's server, which had been left open on port 8888, revealing plans to attack more than 20 organizations.

The attackers persuaded the Anthropic-powered agent to treat the hacks as simulations to circumvent safety refusals. Gambit Security identified 28 chat sessions indicating that the AI assistance increased the speed of the break-ins by 30% to 50%.