Christeyns

Incidents Harmed By

Incident 16613 Report
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

2026-04-08

Between April 8 and May 21, 2026, a Russian-speaking operator linked to the Aurora ransomware group reportedly used Cursor Agent, running Anthropic's Claude Sonnet 4.5, to assist exploitation across multiple organizations. Researchers said some AI-directed tasks succeeded while others failed; independent reporting identified six affected companies but could not determine how much the AI facilitated each breach or whether all led to data theft or extortion.

Related Entities

Aurora ransomware affiliate

Incidents involved as Deployer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Cybercriminals

Incidents involved as Deployer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Ransomware operators

Incidents involved as Deployer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Agentic threat actors

Incidents involved as Deployer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

AI agent system deployers

Incidents involved as Deployer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Anysphere

Incidents involved as Developer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Anthropic

Incidents involved as Developer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

AI agent system developers

Incidents involved as Developer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Large language model developers

Incidents involved as Developer

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Teckentrup

Incidents Harmed By

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Helideck Certification Agency

Incidents Harmed By

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Bayou Title

Incidents Harmed By

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Companies

Incidents Harmed By

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Organizations

Incidents Harmed By

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Cursor

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Claude Sonnet 4.5

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Claude

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

AI agent systems

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Claude AI models

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Large language models

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

LLM-integrated code assistant

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Aurora ransomware

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Ransomware

Incidents implicated systems

Incident 1661
3 Reports
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations