[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEYsRAAEaZRTPdiAH2J5S1hZsH559hIobd2i_Badb7uM":3},{"article":4,"iocs":56,"watch_terms":63,"solutions":64,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"67fd565d-f516-4b6e-8bbd-7a0803c36540","Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets","aurora-ransomware-operators-use-cursor-ai-in-attacks-against-10-targets-457793","Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its","Threat actors linked to the Aurora ransomware have been observed using SpaceX's AI coding assistant, Cursor, to aid in network intrusions. Analyses reveal the operators used Cursor to plan attacks in Russian and exploit Active Directory Certificate Services. The ransomware has both Windows and Linux variants, with the latter designed to shut down virtual machines before encryption.","Aurora ransomware operators leverage Cursor AI for network intrusions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Faurora-ransomware-operators-use-cursor.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhHyB4qaQy8srcEIgc1oMi08PMKtoVFIsmW3ho_7f7rISFML8Kmz8jYzDE1FCN9Nfo4LvvgVFV_FEijgLbCrZcJ5zy7xlvAYTKuyGrcE0IU6yqEd-awlmOyRQ3FXcSeA5yM71NLDa5nxpj9taGnNiVXvCb_5tun5j3dfb6z8j7cmwQ2O0PE2V3y0oKWv6sB\u002Fs1600\u002Fcursor.jpg","2026-08-31T11:47:24+00:00","2026-08-31T14:00:14.437166+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"Cursor","product",{"name":21,"type":22},"SpaceX","vendor",{"name":24,"type":25},"Aurora","threat_actor",{"name":27,"type":28},"Artificial Intelligence","technology",{"name":30,"type":19},"Claude Sonnet",{"name":32,"type":22},"Anthropic","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":33,"icon":35,"name":36,"slug":37},null,"Ransomware","ransomware",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60],{"type":58,"value":24,"context":59},"malware","Ransomware variant",{"type":58,"value":61,"context":62},"Aur0ra","Ransomware variant alias",[21,32,18],{"controls":65,"vendors":149},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":50,"name":96,"problem":97,"products":98},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"slug":124,"name":125,"problem":126,"products":127},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[128,133,141],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":129,"product_name":130,"url":131,"description":132},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":167},"aurora-ransomware-operators-leverage-ai-tools-to-attack-active-directory-certificate-services","Aurora Ransomware Operators Leverage AI Tools to Attack Active Directory Certificate Services","Threat actors behind the Aurora ransomware are exploiting AI coding assistants like Cursor to accelerate and refine their attack planning, including the abuse of Active Directory Certificate Services (ADCS) — a frequently misconfigured and over-privileged component in enterprise environments. This highlights that AI tools are now lowering the technical barrier for attackers, enabling faster exploitation of complex infrastructure weaknesses. The targeting of ADCS is particularly dangerous because certificate-based attacks can grant persistent, high-privilege access that is difficult to detect. The ransomware's ability to shut down virtual machines before encrypting Linux systems also demonstrates sophisticated operational planning designed to maximize damage and prevent recovery. Organizations must treat AI-assisted threats as an accelerant that shortens the window between vulnerability disclosure and active exploitation.",[155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 11: Data Recovery","CIS Control 13: Network Monitoring and Defense","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST IA-5: Authenticator Management (PKI\u002FCertificates)","NIST SI-3: Malicious Code Protection","NIST DE.CM-1: Network Monitoring","MITRE ATT&CK T1649: Steal or Forge Authentication Certificates","MITRE ATT&CK T1486: Data Encrypted for Impact","MITRE ATT&CK T1078: Valid Accounts",{}]