Ransomware Gang Turns Cursor AI Into Attack Aide Arabian Post

(MENAFN- The Arabian Post) clearfix"> A Russian-speaking ransomware operation has used the Cursor artificial intelligence coding agent to support intrusions into corporate networks, exposing how commercial AI assistants can be manipulated to accelerate hacking once attackers gain access to a target.

Operators linked to the Aurora ransomware group employed Cursor Agent during hands-on exploitation of at least 10 organisations between April 8 and May 21, 2026. The AI system helped with network reconnaissance, privilege checks, vulnerability exploitation, credential attacks and the configuration of tools needed to move through compromised environments.

The activity offers one of the clearest documented examples of an agentic AI product being incorporated directly into ransomware operations rather than merely being used to generate malicious code or phishing messages. The attackers supplied credentials or existing routes into victim networks and then instructed the agent to complete specific technical objectives.

MENAFN29082026000152002308ID1111595482