Space Exploration Technologies Corp. (NASDAQ:SPCX) owned AI coding assistant Cursor was used by a “Russian-speaking” Aurora ransomware group to help carry out hands-on hacking against dozens of organizations between April and July.

How The Hackers Used The AI Agent

Cybersecurity firm Gambit said the ransomware group, known as Aurora, used Cursor Agent, which runs on Anthropic’s Claude Sonnet 4.5 model, across ten target organizations between April 8 and May 21.

The tasks ranged from installing VPN clients to running NTLM relay attacks, a technique used to hijack network credentials, and running certificate attacks.

In some sessions, the attacker stated an objective and let the AI figure out how to get there.

The Elon Musk-led company bought Cursor for $60 billion in an all-stock acquisition this year, folding the tool into a new SpaceXAI division.

SpaceX, Cursor, and Anthropic did not immediately respond to Benzinga’s request for comment.

CloudSEK Traces a Wider Campaign

CloudSEK’s separate investigation, based on an exposed directory belonging to an Aurora affiliate, found the operator had compromised more than 20 organizations across nine countries, achieving domain-level access at 17 of them.

The firm said the operator used Cursor mainly for planning, including drafting a full attack plan against Active Directory Certificate Services, written entirely in Russian.

That was “the most heavily worked AI-assisted engagement in the operator’s recovered chat history,” according to the report.

Six Companies Named As Victims

According to a Reuters News report that reviewed the underlying chat data, victims included Belgium’s Christeyns, Germany’s Teckentrup GmbH & Co. KG, Scotland’s Helideck Certification Agency Ltd., an Argentine pharmaceutical distributor, an Italian manufacturer, and Louisiana-based Bayou Title, Inc.

The four companies named here did not immediately respond to a request for comment.

Gambit’s director of threat intelligence, Eyal Sela told Reuters that the AI agent likely helped hackers move “30, 40, 50 percent faster” than working manually, though it did refuse a handful of requests it deemed harmful, prompting attackers to restart conversations while falsely claiming the activity was part of a simulation.

According to Benzinga edge rankings, SpaceX’s stock shows a positive short-term price trend but negative medium and long-term price trends.

Add article title and URL

Photo Courtesy: JRdes on Shutterstock.com