Aurora ransomware operators have been leveraging Cursor, an AI-powered coding assistant, to facilitate network intrusions against multiple targets, as revealed by CloudSEK and Gambit Security through analysis of exposed infrastructure. The Russian-speaking cybercrime group's use of AI tools represents an emerging tactic in ransomware campaigns, demonstrating how legitimate development platforms are being repurposed for malicious objectives.
Read full article at The Hacker News ↗Aurora ransomware operators are leveraging SpaceX's Cursor Agent AI tool to automate reconnaissance and exploitation tasks as part of their ransomware campaigns. This represents a notable shift in adversary tradecraft, with threat actors weaponizing legitimate AI development tools to enhance their operational capabilities.
Berlin has refused to pay a ransom demand following a cyberattack discovered in mid-August that resulted in the theft of government data, according to Governing Mayor Kai Wegner. The city's decision to reject the extortion demand represents a firm stance against capitulating to cybercriminals despite the breach of sensitive municipal information.
McKesson, a major pharmaceutical and healthcare technology company, has warned of service degradation following a cyberattack and notified regulators of the incident. The company is still in early investigation stages regarding a cybersecurity compromise involving an unidentified third-party application. The ongoing impact to McKesson's services underscores the operational risks posed by vulnerabilities in third-party software within critical healthcare infrastructure.
One of Slovenia’s largest gambling and tourism groups has begun reopening its casinos after a cyberattack forced them to shut down for several days.