A Linux home directory sitting on the open internet, served without a password from port 8888, turned out to hold three months of a ransomware operator's work. Researchers at CloudSEK's TRIAD team found Kerberos tickets, credential dumps, Group Policy exports, shell history, AI chat logs and the ransomware itself, filed per organisation.
The operator is an affiliate of Aurora, a ransomware brand that publishes victims who refuse to pay. Between April and July 2026 the directory records more than twenty compromised organisations across nine countries, with domain-level or interactive access reached at seventeen of them. The United States accounts for the largest share. Only four of those victims have appeared on Aurora's leak site, which is the uncomfortable part of the finding: roughly one in five of these intrusions ever became public.
The same break-in, over and over
Every engagement follows one script. Discovery with NetExec over LDAP and SMB, then Kerberoasting and ASREPRoasting to pull crackable password hashes out of Active Directory. Escalation came by one of three routes: a custom-scripted noPac chain, abuse of Active Directory Certificate Services across ESC1, ESC6 and ESC8, or NTLM relay coerced with PetitPotam, PrinterBug and DFSCoerce. Stolen data left in 7-Zip archives cut into 50GB chunks, and every action against a victim ran through rented SOCKS pivots at VPS providers in Germany and the United States.
Attack plans drafted in Russian, with help
In the final weeks the recovered history shows Cursor, an agentic coding assistant, drafting and reasoning through attack sequences, including a full certificate-services exploitation plan written entirely in Russian. CloudSEK assesses with high confidence that the operator is a Russian speaker, noting that no CIS-allocated address range and no CIS-country domain appears anywhere in three months of target lists. It is the same shift we covered when attackers started letting AI write their break-in playbooks.
An encryptor that rewrites the SSH banner
Both lockers, the Windows sap.exe and the Linux and ESXi encrypt.out, are static builds from a single Zig codebase. Zig is a young, still pre-1.0 systems language, and CloudSEK's read is that it stands out rather than hides. On Windows the locker deletes every volume shadow copy and disables System Restore before it starts. On ESXi it force kills every running virtual machine, then writes the ransom note into the host's own SSH login banner instead of dropping a file.
The money does not split the way RaaS is supposed to
A key recovered from the encryptor gave CloudSEK visibility into one concluded ransom negotiation. The wallet the operator supplied held 7 BTC at the time of analysis. Working with TRM Labs, CloudSEK traced that payment on chain and, across Aurora's broader on-chain footprint, identified two confirmed victim payments and two further payments consistent with separate victims, all converging through shared laundering infrastructure, rated high-moderate confidence. The affiliate splits varied at 35/65, 21/79, 46/54 and 40/60, with no ratio repeating, which does not match the fixed cut that ransomware-as-a-service economics usually assume.
Rotate krbtgt twice, then audit your certificate templates
CloudSEK's mitigations target the playbook, not the malware. Audit every certificate-services template for ESC1, ESC6 and ESC8 class misconfigurations and remove the ENROLLEE_SUPPLIES_SUBJECT flag or enforce CA manager approval. Where domain compromise is suspected, rotate the krbtgt password twice with a full replication interval between resets. Disable LLMNR and NBT-NS, enable SMB signing, restrict WinRM to designated administrative hosts, and strip service principal names from privileged accounts.
Indicators, defanged: the Windows locker sap.exe (SHA-256 eb0aab1e892d7e09e2c7bcf1d21fd83c1743ed9196b3efac6c78482fb0d99207), the Linux and ESXi locker encrypt.out (SHA-256 a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe), the ransom note filename !!!README!!!DO_NOT_DELETE.txt, and operator infrastructure at 172[.]86[.]113[.]245 and 89[.]106[.]83[.]49. A Sigma rule for the SSH banner trick and the full victimology are in CloudSEK's report, which says notification to affected organisations and national CERTs began before publication.
The exposure is a reminder that a leak site is a marketing channel, not a ledger. On this operator's own records, most of the organisations it reached never appeared on one at all.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.