Aurora ransomware targets Cursor, prompting discussion of detection
Cursor was targeted by Aurora ransomware. Darktrace’s CEO explained attacks that evade existing defences and behaviour-based detection.
Key facts
- Affected organisation
- Cursor
- Incident type
- Ransomware
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- Aurora ransomware attack
- Location
- Other countries
Timeline
- Aurora ransomware targeting Cursor and the use of behaviour-based detection to counter it were discussed.
1 related reports
Other incidents at Cursor
Malicious Claude Code extensions distributed through Cursor marketplace
5kImpact: Up to 5,000 developers potentially exposed to malware
Tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were distributed through Cursor's extension marketplace for around 11 hours, potentially exposing up to 5,000 developers to malware. The malicious extensions transmitted host information and installed attacker SSH keys and persistence components or attempted to establish reverse SSH tunnels. Cursor removed the packages and temporarily suspended and rebuilt the marketplace. Cursor later confirmed that the malicious extensions had been distributed through a breach using credentials stolen from AI infrastructure provider Fireworks.
Related reports: 5 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.