Security Firm Exposes Aurora Threat Group's Use of Cursor AI and Zig Ransomware

Cybersecurity firm CloudSEK exposed internal data from the Aurora threat group after infiltrating their misconfigured servers. The investigation revealed that the group used the Cursor AI coding assistant to plan cyberattacks and developed cross-platform ransomware using the Zig programming language. This operational exposure highlights an emerging cybersecurity trend where threat actors leverage AI assistants for attack strategy and modern systems languages like Zig to evade security detection across multi-platform environments. It demonstrates how easily commercial developer tooling can be repurposed to streamline cybercrime operations. Aurora's ransomware targets Windows as well as Linux and VMware ESXi environments, hosting payload binaries on public Cloudflare R2 storage and deploying them via SCP protocol. Active since April, the group has breached over 20 organizations across nine countries within just a few months.