Researchers link Aurora ransomware activity to Cursor AI agent use

CloudSEK and Gambit Security reported that operators associated with Aurora ransomware used Cursor's agentic coding tools while working against victim networks. Gambit said it observed Cursor Agent running Anthropic's Claude Sonnet during hands-on exploitation of 10 targets between April 8 and May 21. Recovered activity described tasks including internal scanning, privilege enumeration, NTLM relay attempts and certificate attacks. The reports say many commands did not achieve their objectives on the first try and were refined by the operators.