Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations

Aurora ransomware operators have been observed abusing SpaceX’s Cursor Agent AI to assist post-compromise exploitation against at least 10 victims between April and May 2026, performing reconnaissance, coercing authentication (PetitPotam, Coerce Plus, PrinterBug), running certificate attacks (Certipy), installing VPN/proxychains, and using NetExec and Nmap; researchers also observed a new Linux ransomware variant that targets ESXi hypervisors (encrypting VMs while leaving hypervisors bootable) and a second cluster of activity affecting organizations across multiple countries.