Aurora — Ransomware Profile
Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.IntelFusions coverage (3)
- LockBit leads a four-fold jump in Dutch leak-site listings 2026-09-05 · Cyber Incidents
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
- A ransomware operator's own files exposed 20 victims 2026-08-27 · Ransomware
Tools & malware
- BloodHound AD reconnaissance
- Certipy ADCS abuse tool
- Chisel Tunneling tool
- Cursor AI coding agent (abused)
- DFSCoerce NTLM coercion tool
- Evil-WinRM Remote shell
- GodPotato Privilege escalation tool
- Hashcat Password cracker
- Impacket ntlmrelayx NTLM relay tool
- John the Ripper Password cracker
- Kerbrute Kerberos brute-force tool
- Metasploit Exploitation framework
- NetExec Network exploitation toolkit
- Nmap Network scanner
- PetitPotam NTLM coercion tool
- PKINITtools Kerberos PKINIT tooling
- PrinterBug NTLM coercion tool
- Proxychains Proxy tool
- s5cmd S3 transfer tool
Recent claimed victims
- Benshaw, Inc. 2026-09-07
- Jinny Beauty Supply 2026-09-07
- Metrea LLC/Commuter Air Technology, Inc. 2026-09-05
- EDIF S.p.A. 2026-09-04
- Chip 1 Exchange 2026-09-02
- Ishbia & Gagleard, P.C. 2026-08-31
- SCA Logistik & Fulfillment GmbH 2026-08-27
- ERPIS LLC 2026-08-26
- Planungsgruppe M+M AG 2026-08-17
- Natco Home Group 2026-08-17
- Lloyd Coils Europe 2026-08-17
- FREYWILLE 2026-08-11
- US Installation Group, Inc. 2026-08-04
- GILDE Handwerk Macrander GmbH & Co. KG 2026-08-04
- Pyramid Analytics B.V. 2026-07-30
- Evosys Laser GmbH 2026-07-30
- Van Eijck International Car Rescue 2026-07-30
- Bretford Manufacturing 2026-07-29
- Primed Halberstadt Medizintechnik 2026-06-30
- Corporación Primax S.A. 2026-06-23
- NTP B.V. Civil Engineering Construction 2026-06-22
- Kochs GmbH 2026-06-22
- NationsBuilders Insurance Services 2026-06-22
- Aerospace & Advanced Composites GmbH 2026-06-22
- Hagerman & Company 2026-06-19
Vendor research
- Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation Gambit Security
- CloudSEK's report CloudSEK
- Weekly Intelligence Report – 22 May 2026 CYFIRMA
- Aur0ra Ransomware: Silent encryption targeting windows shadow copies Cohesity REDLab