Aurora — Ransomware Profile
Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.IntelFusions coverage (6)
- Google sees AI hacking agents run real break-ins in seconds 2026-11-01 · AI Security
- Aur0ra ransomware crew let AI agents run its break-ins 2026-10-29 · Ransomware
- Drugmaker Roemmers tops a week of health leak-site claims 2026-10-04 · Cyber Incidents
- LockBit leads a four-fold jump in Dutch leak-site listings 2026-09-05 · Cyber Incidents
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
- A ransomware operator's own files exposed 20 victims 2026-08-27 · Ransomware
Tools & malware
- BloodHound AD reconnaissance
- Certipy ADCS abuse tool
- Chisel Tunneling tool
- Cursor AI coding agent (abused)
- DFSCoerce NTLM coercion tool
- Evil-WinRM Remote shell
- GodPotato Privilege escalation tool
- Hashcat Password cracker
- Impacket ntlmrelayx NTLM relay tool
- John the Ripper Password cracker
- Kerbrute Kerberos brute-force tool
- Metasploit Exploitation framework
- NetExec Network exploitation toolkit
- Nmap Network scanner
- PetitPotam NTLM coercion tool
- PKINITtools Kerberos PKINIT tooling
- PrinterBug NTLM coercion tool
- Proxychains Proxy tool
- s5cmd S3 transfer tool
Recent claimed victims
- Rapid Manufacturing 2026-10-30
- CP Manufacturing, Inc. 2026-10-30
- Meleghy Automotive & Cie. GmbH 2026-10-28
- EWM Group 2026-10-28
- GreenbergFarrow 2026-10-27
- Ernesto Malvestiti S.p.A. 2026-10-26
- ARX Group SA 2026-10-23
- Allmand-Smith Limited 2026-10-21
- Duarte Nursery, Inc. 2026-10-20
- POWERsonic Industries Inc. 2026-10-19
- Adams Warehouse & Delivery, Inc. 2026-10-16
- Estrategias BigMat S.L.U. 2026-10-14
- The Buckner Company, Inc. 2026-10-13
- Rechtsanwaltskanzlei Dr. Bien 2026-10-12
- Infomedia A/S 2026-10-05
- Thomas Y. Pickett & Co., Inc. 2026-10-05
- Laboratorios Roemmers SAICF 2026-10-01
- Buford-Thompson Company, LTD 2026-09-30
- Benshaw, Inc. 2026-09-07
- Jinny Beauty Supply 2026-09-07
- Metrea LLC/Commuter Air Technology, Inc. 2026-09-05
- EDIF S.p.A. 2026-09-04
- Chip 1 Exchange 2026-09-02
- Ishbia & Gagleard, P.C. 2026-08-31
- SCA Logistik & Fulfillment GmbH 2026-08-27
Vendor research
- Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation Gambit Security
- CloudSEK's report CloudSEK
- Weekly Intelligence Report – 22 May 2026 CYFIRMA
- Aur0ra Ransomware: Silent encryption targeting windows shadow copies Cohesity REDLab