Aurora ransomware gang used Cursor to speed up attacks: 30% to 50% faster intrusions

From April through July 2026, Aurora ransomware operators used Cursor, the coding assistant recently acquired by SpaceX, during intrusions inside victim networks, according to new research from Gambit Security and CloudSEK.

The researchers say Cursor wasn’t used to build the ransomware itself. Once Aurora was already inside, the operators leaned on it for reconnaissance, exploitation, credential theft, network scanning, command generation, lateral movement, and command-line troubleshooting when something broke.

Gambit Security and CloudSEK say that turned Cursor into an always-available operations helper, something attackers could query for the next move after a tool failed or a command didn’t work. They estimate it cut intrusion time by 30% to 50% and reduced the need for specialist skills.

If you track cybercrime or spend your time defending enterprise networks, this report is worth reading.

According to Gambit Security and CloudSEK, data from an exposed Aurora affiliate server showed activity from April to July 2026 targeting more than 20 organizations in at least nine countries, including the US, Belgium, Germany, Scotland, Italy, and Argentina. The researchers say the data suggests Cursor was a routine part of the workflow, not some side experiment.

They also say Aurora operators got around some guardrails by framing malicious requests as penetration-testing or simulation exercises. That raises the stakes for vendors, who need stronger abuse checks, and for defenders, who may need more automated defenses to keep up.

You can read the full Gambit Security and CloudSEK findings online.

Author: Anthony John Padilla

{ "social": { "email": "content.reviewer90@ext.softonic.com", "facebook": "", "twitter": "", "linkedin": "" }, "ja-JP": "", "de-DE": "Anthony Padilla ist ein auf den Philippinen ansässiger Schriftsteller mit Erfahrung in redaktionellen, digitalen und markenorientierten Inhalten. Seine Arbeit konzentriert sich darauf, komplexe Ideen in klare, verständliche Texte umzuwandeln.", "en-US": "Anthony Padilla is a Philippines-based writer with experience across editorial, digital, and brand-focused content. His work centers on translating complex ideas into clear, accessible copy, with a strong emphasis on structure, accuracy, and user-focused communication. He has contributed to long-form articles, product and platform copy, and marketing-led editorial pieces.", "es-ES": "Anthony Padilla es un escritor con base en Filipinas con experiencia en contenido editorial, digital y enfocado en marca. Su trabajo se centra en traducir ideas complejas en textos claros y accesibles.", "fr-FR": "Anthony Padilla est un écrivain basé aux Philippines ayant de l'expérience dans le contenu éditorial, numérique et axé sur la marque. Son travail consiste à traduire des idées complexes en textes clairs et accessibles.", "it-IT": "Anthony Padilla è uno scrittore con base nelle Filippine con esperienza in contenuti editoriali, digitali e focalizzati sul brand. Il suo lavoro si concentra sulla traduzione di idee complesse in testi chiari e accessibili.", "nl-NL": "Anthony Padilla is een schrijver gevestigd op de Filipijnen met ervaring in redactionele, digitale en merkgerichte content. Zijn werk richt zich op het vertalen van complexe ideeën naar helder, begrijpelijke teksten.", "pl-PL": "Anthony Padilla to pisarz mieszkający na Filipinach z doświadczeniem w tworzeniu treści redakcyjnych, cyfrowych i skoncentrowanych na marce. Jego prace skupiają się na przekształcaniu skomplikowanych idei w jasne, zrozumiałe teksty.", "pt-BR": "Anthony Padilla é um escritor baseado nas Filipinas com experiência em conteúdo editorial, digital e focado em marca. Seu trabalho se concentra em traduzir ideias complexas em textos claros e acessíveis." }