Search threats, CVEs… ⌘K
← Back to all threat actors

aurora

Also known as Aur0ra

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-04-29
Last seen
2026-10-26
Sectors
manufacturing, professional-services, transportation, healthcare, technology, business-services, retail-e-commerce, financial-services, transportation-logistics, hospitality, other, agriculture-and-food-production
Status
Active

Threat intelligence assessment

At a glance

Facts

  • Russian-speaking cybercrime group associated with Aurora ransomware
  • Details first emerged in late May 2026

Activity timeline

Facts

  • Active against more than 20 organizations across nine countries between April and July 2026
  • 33 victims listed on Ransomware.Live located in U.S., Germany, Netherlands, Canada, and U.K.
  • Four victims listed on its data leak site

Initial access and identity targets

Facts

  • Aggressive email bombing followed by phone calls posing as IT help desk personnel
  • Establishing remote access using Xray-core

Capabilities and evasion

Facts

  • Windows and Linux versions of Aurora written in Zig
  • Windows variant (sap.exe) deletes volume shadow copies and disables System Restore via Registry
  • Linux and ESXi variant (encrypt.out) kills virtual machines prior to encryption
  • Lateral movement via SMB, LDAP, WinRM, RDP, and RPC
  • Active Directory Certificate Services (AD CS) exploitation
  • Clearing logs and disabling Microsoft Defender

Infrastructure patterns

Facts

  • Exposed open directory leaked months of activity
  • Four cryptocurrency wallets showing varying splits between affiliates and operators
  • Affiliates receive between 54% and 79% of ransom amounts

Communication and pressure channels

Facts

  • Used Cursor AI coding assistant to plan attacks in Russian
  • Heavy use of Cursor for planning various attack phases

Observed targeting

Facts

  • Excluding CIS ranges and CIS-country domains without exception
  • Targeting Windows systems primarily

Named victims

Organizations

  • Christeyns
  • Teckentrup
  • Helideck Certification Agency
  • Bayou Title
  • Argentine pharmaceutical distributor
  • Italian manufacturer

Defender guidance

Facts

  • Monitor for use of Cursor AI agent in exploitation activities
  • Watch for credential stuffing and NTLM relay attacks
  • Track anomalous AD CS exploitation attempts

Reported detail

Facts

  • Aurora ransomware operators used Cursor AI coding assistant to plan and conduct attacks against 10 targets between April and May 2026, with exposed infrastructure revealing months of activity.
  • The group developed dual Windows and Linux encryptors written in Zig, with capabilities for disabling recovery systems and killing virtual machines before encryption.
  • Initial access was achieved through email bombing and social engineering phone calls impersonating IT help desk, followed by lateral movement using standard Windows administration tools.
  • Recovered chat history and infrastructure showed the Russian-speaking group explicitly excluded Commonwealth of Independent States networks from targeting.
  • Affiliate-based ransomware model provided operators between 21% and 46% of ransom payments, with splits determined per victim based on ransom amount and victim revenue.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Claimed
Victim claimGreenbergFarrow listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimErnesto Malvestiti S.p.A. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

First listed
Victim claimARX Group SA listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAllmand-Smith Limited listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDuarte Nursery, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPOWERsonic Industries Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAdams Warehouse & Delivery, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEstrategias BigMat S.L.U. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimThe Buckner Company, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRechtsanwaltskanzlei Dr. Bien listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThomas Y. Pickett & Co., Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimInfomedia A/S listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimLaboratorios Roemmers SAICF listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBuford-Thompson Company, LTD listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBenshaw, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimJinny Beauty Supply listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimMetrea LLC/Commuter Air Technology, Inc. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimChip 1 Exchange listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
IdentityAlias: Aur0ra

Reviewed identity mapping approved on this date.

Claimed
Victim claimIshbia & Gagleard, P.C. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
Indicator11 indicators cataloged

Types: domain, tool.

Cataloged
IdentityAlias: Aur0ra

Reviewed identity mapping approved on this date.

Claimed
Victim claimSCA Logistik & Fulfillment GmbH listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEDIF S.p.A. listed by aurora

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 57 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

auroraCanonical Name
Aur0raAlias

Loading CVEs, techniques, indicators, malware, victims, and activity...