Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora ransomware operators have used SpaceX's AI coding assistant Cursor to plan and execute attacks on over 20 organizations across nine countries between April and July 2026. The group targets Windows and Linux systems, employing tactics like email bombing, social engineering, and lateral movement to deploy their encryptor and exfiltrate data.