Ransomware got an AI assistant: Cursor helped with real-world attacks on companies

This was not a lab test or a demonstration of what a model can do. On August 27, CloudSEK researchers described a real ransomware campaign in which a Russian-speaking operator used the Cursor agent to plan and carry out attacks on companies. Evidence recovered from the server shows that the attacker targeted more than 20 organizations and actively used Cursor to map out the next stages of the intrusions.

What did the researchers actually find?

CloudSEK found a poorly secured server belonging to an operator linked to the Aurora group. The server was accessible without authentication and contained something like an attacker’s digital workbench: command history, tools, stolen credentials, ransomware code, data from multiple corporate networks, and logs of conversations with the Cursor agent.

In CloudSEK’s original report from August 27, 2026, the researchers say the operator attacked more than 20 organizations across nine countries and gained domain or interactive access to 17 of them. In the section on attack planning, they explicitly state that Cursor was used during the attacks, including to prepare complete plans for exploiting weaknesses in corporate authentication infrastructure.

This distinction matters: the AI did not choose a target by itself and did not independently start looking for victims. A human ran the ransomware campaign, selected targets, and supplied the context. The agent acted as a very fast technical assistant that could analyze the situation and lay out the next steps.

What was Cursor doing?

According to the source material, the recovered sessions show a long, multi-stage collaboration with the tool. The operator used it to plan attacks on Active Directory, the system many companies use to manage employee accounts, computers, and permissions. Taking control of that environment often gives an attacker access to a large part of an organization.

In the same environment, researchers found tools for stealing passwords, taking over accounts, moving between computers, extracting data, and attacking backup systems. The ransomware even had a separate mode for ESXi virtualization servers: it first stopped running virtual machines and only then encrypted their files.

Why is this case more important than another story about AI writing malware?

Because here AI was part of a criminal’s real work against real companies. The question is not whether a chatbot can generate a piece of malicious code. It is about putting a commercial agent into the normal workflow of an intrusion: you analyze the result, ask what to do next, receive a plan, carry out the step, return with new data, and continue.

It is a bit like the difference between a search engine and an extra member of the team. A search engine gives you documentation. An agent can retain the context of the entire operation and continuously help connect the individual parts of the attack into one coherent attack path.

Does this mean companies should be afraid of Cursor or Claude?

Not in that sense. The report does not show that Cursor attacked companies on its own, or that installing the tool causes a breach. It shows something else: a capable agent can significantly reduce the amount of knowledge and time a human needs to carry out successive stages of an attack.

For a business owner, the most important consequence is fairly ordinary. Old configuration mistakes, weak passwords, poorly secured administrator accounts, and backups accessible from the same network did not suddenly become safe just because the attack methods have been known for years. Quite the opposite. If AI shortens the attacker’s path from finding a problem to exploiting it, defenders have less time to react.

What should a company do now?

There is no magic update called “AI protection”. CloudSEK’s report points to very traditional problems: old protocols, weak directory service configuration, overly broad permissions, stored credentials, and backups accessible from the production environment. A company should first know who is responsible for updates, privileged accounts, backups, and incident response. If nobody can answer those four questions, the attacker’s AI agent is only the fifth problem.

WebsiteGarage says

The most interesting part of this case is not that a criminal used AI. Criminals use anything that saves time and improves their chances of success. What is more interesting is the speed at which tools designed to help programmers are starting to serve as an extra specialist on either side of the fence. A good agent does not need to discover a new kind of attack. It is enough if it makes an old attack faster, more consistent, and easier for someone with less experience to carry out.

That is less cinematic, but far more relevant to business than a story about rebellious artificial intelligence. A company can still lose because of an old password, a badly configured server, or a backup connected to the same network. The difference is that someone on the other side has just gained a very patient assistant.