Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
aurora ransomware
*/
rule aurora_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.aurora"
description = "Detects aurora ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "aurora" ascii nocase
$name2 = "AURORA" ascii
$onion = "aurora.onion" ascii nocase
condition:
any of them
}
We have downloaded confidential information files. Your files are encrypted. Contact us via tor browser at [redactado] Your access key: [snip]
[distribution] Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a French cooperative and one of Europe's largest building materials distribution networks. 624 SEPA payroll XML files (2022–2025) — every monthly salary payment for 300–500 employees across 15+ entities, with full names, DNI/NIE numbers, IBANs, and exact euro amounts. 20 SILTRA Social Security databases — the complete filing history for every subsidiary's workforce, containing números de afiliación, contribution bases, and employment records. <redacted> 2,690 customer loyalty cards with DNI/NIF identifiers — the entire customer-identity database. 888 Modelo 347 tax notifications — annual declarations to the Agencia Tributaria naming customers and suppliers with their DNI and transaction amounts. Complete financial records — 5 years of accounting journals, bank reconciliations, insurance policies, loan agreements, and invoices. Occupational health data (PRL) for 12+ subsidiaries — workplace injury reports, medical certificates, and risk assessments.
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| Estrategias BigMat S.L.U. | ES | Retail & E-Commerce | — | 14 oct 2026 |
| The Buckner Company, Inc. | US | Other | — | 13 oct 2026 |
| Rechtsanwaltskanzlei Dr. Bien | DE | Professional Services | — | 12 oct 2026 |
| Infomedia A/S | DK | Technology | — | 5 oct 2026 |
| Thomas Y. Pickett & Co., Inc. | US | Professional Services | — | 5 oct 2026 |
| Laboratorios Roemmers SAICF | AR | Healthcare | — | 1 oct 2026 |
| Buford-Thompson Company, LTD | US | Manufacturing | — | 30 sept 2026 |
| Jinny Beauty Supply | US | Retail & E-Commerce | — | 7 sept 2026 |
| Metrea LLC/Commuter Air Technology, Inc. | US | Transportation | — | 5 sept 2026 |
| Chip 1 Exchange | US | Technology | — | 2 sept 2026 |
| Ishbia & Gagleard, P.C. | US | Professional Services | — | 31 ago 2026 |
| SCA Logistik & Fulfillment GmbH | DE | Transportation | — | 27 ago 2026 |
| ERPIS LLC | Professional Services | — | 26 ago 2026 | |
| Planungsgruppe M+M AG | DE | Professional Services | — | 17 ago 2026 |
| Natco Home Group | US | Retail & E-Commerce | — | 17 ago 2026 |
| Lloyd Coils Europe | GB | Manufacturing | — | 17 ago 2026 |
| FREYWILLE | AT | Retail & E-Commerce | — | 11 ago 2026 |
| GILDE Handwerk Macrander GmbH & Co. KG | DE | Manufacturing | — | 4 ago 2026 |
| US Installation Group, Inc. | US | Manufacturing | — | 4 ago 2026 |
| Van Eijck International Car Rescue | NL | Transportation | — | 30 jul 2026 |
| Evosys Laser GmbH | DE | Manufacturing | — | 30 jul 2026 |
| Pyramid Analytics B.V. | NL | Technology | — | 30 jul 2026 |
| Bretford Manufacturing | US | Manufacturing | — | 29 jul 2026 |
| Primed Halberstadt Medizintechnik | DE | Healthcare | — | 30 jun 2026 |
| Corporación Primax S.A. | PE | Retail & E-Commerce | — | 23 jun 2026 |
| Aerospace & Advanced Composites GmbH | DE | Manufacturing | — | 22 jun 2026 |
| NTP B.V. Civil Engineering Construction | NL | Construction | — | 22 jun 2026 |
| Kochs GmbH | DE | Manufacturing | — | 22 jun 2026 |
| NationsBuilders Insurance Services | Financial Services | — | 22 jun 2026 | |
| Hagerman & Company | Business Services | — | 19 jun 2026 | |
| Allan Brothers Fruit | US | Agriculture and Food Production | — | 16 jun 2026 |
| Diamond Truck Centres | CA | Transportation/Logistics | — | 16 jun 2026 |
| Sumitomo Electric Bordnetze | DE | Manufacturing | — | 16 jun 2026 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
[insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado. The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennett’s file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts. Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports. 316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history — every employee’s salary, bonus, and benefits laid bare. A complete M&A acquisition pipeline — 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents). 128 Outlook PST email archives spanning years of business correspondence. Corporate tax returns for Buckner (2004–2024), Citrus Insurance LLC (2021–2023), and Consolidated Agencies (2022–2023). 7 named individuals’ driver license scans and the Applied Epic insurance management database (Epic.mdf).
[law] Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen. The exposed material includes: 2,387 WinSolvenz case databases — each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details. 492+ forced administration (Zwangsverwaltung) case files — property addresses, tenant data, rent records, utility accounts, insurance details, court-directed property management reports. <redacted> 80 GB MailStore email archive — the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures. 1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court. 35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements. DATEV tax/accounting archives — 33 directories of income tax backups, insolvency accounting, third-party mandates.
[monitoring] Infomedia A/S — Denmark's premier media monitoring company, co-owned by the country's two largest media conglomerates (JP/Politikens Hus and Berlingske Media). Infomedia sits at the heart of Nordic media. It monitors newspapers, broadcasts, and digital sources for hundreds of corporate and government clients — including the EU Parliament, A.P. Møller-Mærsk, and major Nordic media groups (Schibsted, Polaris, NRK, Amedia). The exposed material spans: <redacted> <redacted> SQL Server sysadmin credentials — sa / ballmer for the Opoint CRM database at crmdb.opoint.com. An RSA private key — the TLS key for the Infomedia Export Data API service. Named salary specifications for 100+ employees across Denmark (2010–2018) and Estonia (2009–2024). 30 GB of Finance data — income statements, balance sheets, insurance policies, Danske Bank payment records, vendor contracts, tax certificates. <redacted> <redacted>
[consulting] Thomas Y. Pickett & Co., Inc. — founded in 1926, headquartered in Addison/Dallas, Texas — is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation. Inventory: 13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials Complete HR records for all 40+ employees — Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices 11 GB Azure DevOps repository — the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices 200+ client contracts with pricing for every county appraisal district they serve — the competitive intelligence gold mine Complete financial records — bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025 A developer's password exposed in a directory name visible to anyone who looks at the file listing A PKCS#12 digital signing certificate (private key) for an HR manager — enabling document forgery
Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue, with €1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) — Argentina's equivalent of a Social Security Number — combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records — employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms — individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers. <redacted> 82 GB of drug formulations — the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain. 14 GB of internal drug pricing strategy and competitive intelligence