Search threats, CVEs… ⌘K
← Back to all threat actors

aurora

Also known as Aur0ra

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-04-29
Last seen
2026-09-07
Sectors
manufacturing, professional-services, transportation, business-services, healthcare, financial-services, technology, transportation-logistics, hospitality, retail-e-commerce, agriculture-and-food-production, construction
Status
Active

Threat intelligence assessment

At a glance

Facts

  • Russian-speaking cybercrime group associated with Aurora ransomware
  • Details first emerged in late May 2026

Activity timeline

Facts

  • Active against more than 20 organizations across nine countries between April and July 2026
  • 33 victims listed on Ransomware.Live located in U.S., Germany, Netherlands, Canada, and U.K.
  • Four victims listed on its data leak site

Initial access and identity targets

Facts

  • Aggressive email bombing followed by phone calls posing as IT help desk personnel
  • Establishing remote access using Xray-core

Capabilities and evasion

Facts

  • Windows and Linux versions of Aurora written in Zig
  • Windows variant (sap.exe) deletes volume shadow copies and disables System Restore via Registry
  • Linux and ESXi variant (encrypt.out) kills virtual machines prior to encryption
  • Lateral movement via SMB, LDAP, WinRM, RDP, and RPC
  • Active Directory Certificate Services (AD CS) exploitation
  • Clearing logs and disabling Microsoft Defender

Infrastructure patterns

Facts

  • Exposed open directory leaked months of activity
  • Four cryptocurrency wallets showing varying splits between affiliates and operators
  • Affiliates receive between 54% and 79% of ransom amounts

Communication and pressure channels

Facts

  • Used Cursor AI coding assistant to plan attacks in Russian
  • Heavy use of Cursor for planning various attack phases

Observed targeting

Facts

  • Excluding CIS ranges and CIS-country domains without exception
  • Targeting Windows systems primarily

Named victims

Organizations

  • Christeyns
  • Teckentrup
  • Helideck Certification Agency
  • Bayou Title
  • Argentine pharmaceutical distributor
  • Italian manufacturer

Defender guidance

Facts

  • Monitor for use of Cursor AI agent in exploitation activities
  • Watch for credential stuffing and NTLM relay attacks
  • Track anomalous AD CS exploitation attempts

Reported detail

Facts

  • Aurora ransomware operators used Cursor AI coding assistant to plan and conduct attacks against 10 targets between April and May 2026, with exposed infrastructure revealing months of activity.
  • The group developed dual Windows and Linux encryptors written in Zig, with capabilities for disabling recovery systems and killing virtual machines before encryption.
  • Initial access was achieved through email bombing and social engineering phone calls impersonating IT help desk, followed by lateral movement using standard Windows administration tools.
  • Recovered chat history and infrastructure showed the Russian-speaking group explicitly excluded Commonwealth of Independent States networks from targeting.
  • Affiliate-based ransomware model provided operators between 21% and 46% of ransom payments, with splits determined per victim based on ransom amount and victim revenue.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimBenshaw, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimJinny Beauty Supply listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

Claimed
Victim claimMetrea LLC/Commuter Air Technology, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimChip 1 Exchange listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
IdentityAlias: Aur0ra

Reviewed identity mapping approved on this date.

Claimed
Victim claimIshbia & Gagleard, P.C. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
Indicator11 indicators cataloged

Types: domain, tool.

Cataloged
IdentityAlias: Aur0ra

Reviewed identity mapping approved on this date.

Claimed
Victim claimSCA Logistik & Fulfillment GmbH listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEDIF S.p.A. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimERPIS LLC listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimLloyd Coils Europe listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPlanungsgruppe M+M AG listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNatco Home Group listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFREYWILLE listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimGILDE Handwerk Macrander GmbH & Co. KG listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimUS Installation Group, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimVan Eijck International Car Rescue listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEvosys Laser GmbH listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimPyramid Analytics B.V. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBretford Manufacturing listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimPrimed Halberstadt Medizintechnik listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimCorporación Primax S.A. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimNTP B.V. Civil Engineering Construction listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 43 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

auroraCanonical Name
Aur0raAlias

Loading CVEs, techniques, indicators, malware, victims, and activity...