The ransomware crew wrote its targeting rule into a prompt: plan the attack, skip anything in the CIS
2026-09-01Security
Aurora used the AI coding assistant Cursor to plan intrusions in Russian — AD CS exploitation, NTLM relay, domain enumeration — while instructing it to exclude CIS address ranges and domains. More than 20 organisations across nine countries between April and July. Also: Cursor is made by Anysphere, not SpaceX, whatever you are about to read elsewhere.