Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
aurora ransomware
*/
rule aurora_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.aurora"
description = "Detects aurora ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "aurora" ascii nocase
$name2 = "AURORA" ascii
$onion = "aurora.onion" ascii nocase
condition:
any of them
}
We have downloaded confidential information files. Your files are encrypted. Contact us via tor browser at [redactado] Your access key: [snip]
[logistics] SCA is a Bavarian logistics and e-commerce fulfillment provider. The exposed materials includes: Spans customer orders Shipments and returns Employee and applicant files Management, tax and banking records Warehouse automation Source code Customer contracts.
[software] ERPIS LLC (doing business as ShipERP) — a Texas-based SAP integrator whose single product is enterprise shipping management software used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers. The exposed material includes: Complete product source code — all versions (2.0–5.4) of ShipERP's ABAP source, the company's sole revenue-generating asset ($20.6M backlog) <redacted> Live QuickBooks financial database (705 MB) — complete payroll (SSN, bank accounts, salaries), vendor banking details, AR/AP, and general ledger Full customer contract register — exact pricing for all 88 enterprise customers with $20.6M in deferred revenue <redacted> SAP installation media (245 GB) — full HANA, S/4HANA, and kernel distributions <redacted>
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| SCA Logistik & Fulfillment GmbH | DE | Transportation | — | 27 ago 2026 |
| ERPIS LLC | Professional Services | — | 26 ago 2026 | |
| Planungsgruppe M+M AG | DE | Professional Services | — | 17 ago 2026 |
| Natco Home Group | US | Retail & E-Commerce | — | 17 ago 2026 |
| Lloyd Coils Europe | GB | Manufacturing | — | 17 ago 2026 |
| FREYWILLE | AT | Retail & E-Commerce | — | 11 ago 2026 |
| GILDE Handwerk Macrander GmbH & Co. KG | DE | Manufacturing | — | 4 ago 2026 |
| US Installation Group, Inc. | US | Manufacturing | — | 4 ago 2026 |
| Van Eijck International Car Rescue | NL | Transportation | — | 30 jul 2026 |
| Evosys Laser GmbH | DE | Manufacturing | — | 30 jul 2026 |
| Pyramid Analytics B.V. | NL | Technology | — | 30 jul 2026 |
| Bretford Manufacturing | US | Manufacturing | — | 29 jul 2026 |
| Primed Halberstadt Medizintechnik | DE | Healthcare | — | 30 jun 2026 |
| Corporación Primax S.A. | PE | Retail & E-Commerce | — | 23 jun 2026 |
| Aerospace & Advanced Composites GmbH | DE | Manufacturing | — | 22 jun 2026 |
| NTP B.V. Civil Engineering Construction | NL | Construction | — | 22 jun 2026 |
| Kochs GmbH | DE | Manufacturing | — | 22 jun 2026 |
| NationsBuilders Insurance Services | Financial Services | — | 22 jun 2026 | |
| Hagerman & Company | Business Services | — | 19 jun 2026 | |
| Allan Brothers Fruit | US | Agriculture and Food Production | — | 16 jun 2026 |
| Diamond Truck Centres | CA | Transportation/Logistics | — | 16 jun 2026 |
| Sumitomo Electric Bordnetze | DE | Manufacturing | — | 16 jun 2026 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with approximately 432 employees across 10 offices (Böblingen, Stuttgart, München, Nürnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately €52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation. The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data — a total of 268 GB across approximately 124,000 files, covering 2006 to 2026.
[manufacturer] Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. <censored> <censored> <censored> <censored> Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials.
[manufacturer] 4 Coils Technology s.r.o. (trading as Lloyd Coils Europe) is a Czech-headquartered manufacturer of custom heat exchangers for the HVAC&R industry, with offices in Germany, France, and the United Kingdom. They serve 200+ OEM customers across 39 countries — names like Carrier, Daikin, Trane, Systemair, Remak, GEA, Swegon, and VTS. Their competitive advantage comes from two things: decades of thermodynamic engineering expertise embodied in their MyCoil selection software (licensed to OEM customers worldwide), and a manufacturing capability for custom heat exchangers. Approximately 200 employees work across four countries.
[jewelry] FREYWILLE — the Austrian luxury fire-enamel jewelry house with 70+ boutiques across Europe, the Americas, Middle East, Russia/CIS, and Asia-Pacific. <censored> <censored> 142+ employee files with salary statements (2024–2026), social security numbers (ELDA), employment contracts across 24 countries, COVID vaccination records, passport copies, visa card statements spanning a decade, and personnel files. FREYWILLE's trade secrets — complete 2025 product costing for all lines (18ct gold, plated, textiles), and the crown jewels: enamel colour recipes from the Siebdruck department. FREYWILLE's fire-enamel technique is what makes the brand unique. The formulations for SPHINX, JOYB2, and Entwurf colour systems are in the dataset. Defence files from 40+ lawsuits across Austria, the US, China, France, Canada, Slovakia, Poland, and Belgium — including a criminal proceedings file (Strafsache Grgic, Mrsic & Co). Documentation of the 2018 webshop malware attack — DSB filings, customer notification drafts, incident reports.