Aurora ransomware group uses Cursor AI in attacks on 10 targets

CloudSEK and Gambit Security found Aurora ransomware operators used SpaceX's Cursor AI coding assistant to plan attacks in Russian, targeting over 20 organizations across nine countries between April and July 2026. Four victims were listed on its leak site.