Aurora ransomware crew caught using Cursor AI to break into networks

Key points

• Researchers link the Aurora ransomware group, also tracked as Aur0ra, to intrusions at around 10 organisations.
• The gang used Cursor, an AI coding assistant developed by a company backed by SpaceX, to help write and refine its attack tools.
• CloudSEK and Gambit Security reached the same conclusion independently after finding exposed servers run by the criminals.
• The operators appear to be Russian-speaking, based on language artefacts left on their infrastructure.
• Attribution to a wider named cluster is not yet public, so treat single-source claims with caution.

A Russian-speaking ransomware crew has been caught using an AI coding assistant to help build the tools it uses to break into company networks.

The group runs a strain of ransomware, meaning malicious software that locks a company's files until a payment is made, tracked as Aurora (also written Aur0ra). Two security firms, CloudSEK and Gambit Security, say they reached the same finding on their own after stumbling across servers the gang had left exposed on the internet. The Hacker News first surfaced the joint reporting.

What makes the case notable is the tool the criminals reached for. They used Cursor, an AI-powered coding assistant built by Anysphere, a startup that counts SpaceX among its backers. Cursor is sold to software developers as a way to write and fix code faster. The Aurora operators appear to have used it the same way, only for malware.

Who are the Aurora hackers?

Aurora is a small ransomware operation, not one of the household names like LockBit or BlackCat. Researchers describe the operators as Russian-speaking, based on language fragments and tooling left behind on the exposed servers. That is a common clue but a soft one, so the attribution sits at medium confidence at best. No public link has been drawn yet to a larger tracked cluster.

The two firms say they identified roughly 10 victim organisations tied to the group's infrastructure. Names have not been published.

How were they using Cursor?

The gang used Cursor as a coding helper while building and tweaking the software it deploys inside victim networks. In plain terms: instead of writing every line of their attack code from scratch, the operators asked the AI to draft pieces of it, then refined the output. It is the same shortcut a legitimate developer would take, applied to criminal work.

This is not the AI itself launching attacks. It is people using a commercial AI product to move faster. The distinction matters for how defenders and vendors respond.

Should ordinary people be worried?

Not directly, and not today. Aurora is a niche operation and the 10 known victims are companies, not consumers. The wider concern is what this case signals: criminal groups are quietly folding mainstream AI coding tools into their workflow, which lowers the skill needed to build working malware.

For staff at any organisation, the practical advice does not change. Be wary of unexpected email attachments and login prompts, and report anything odd to your IT team quickly. Ransomware crews almost always get their first foothold through a person clicking something they should not, or a stolen password being reused.

What happens next

Expect Anysphere and other AI coding vendors to face harder questions about how their tools are used, and expect more reports like this one. Distinguishing capability (AI writes code faster) from intent (a specific gang chose to abuse it) will matter as the story develops. For now, treat Aurora as a small but real operator that has found a productivity boost, and watch for confirmation from a third source before assuming the scale is larger than 10.