Aurora

☆ pin

Also known as Aur0ra

Reports

First seen

May 12, 2026

Last seen

Oct 16, 2026

Motivation

Financial

Targeting

Sectors

Manufacturing ×12 Retail & E-commerce ×7 Professional Services ×5 Transport & Logistics ×3 Other ×2 Technology ×2 Financial Services ×2 Healthcare ×2

Victim regions

×1

×17

United States×17

Germany×9

Netherlands×3

Austria×2

Canada×2

Spain×2

Peru×1

Australia×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×2T1560 Archive Collected Data ×2T1005 Data from Local System ×2T1486 Data Encrypted for Impact ×1T1490 Inhibit System Recovery ×1T1021 Remote Services ×1T1018 Remote System Discovery ×1T1087 Account Discovery ×1T1598 Phishing for Information ×1T1566 Phishing ×1T1133 External Remote Services ×1T1003 OS Credential Dumping ×1

Indicators

domain ×44ip_v4 ×4filename ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Aurora

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Aurora ransomware publishes Adams Warehouse & Delivery, Inc. data

Aurora ransomware publishes Estrategias BigMat S.L.U. data

Aurora ransomware claims Estrategias BigMat S.L.U. victim

Aurora ransomware gang publishes The Buckner Company data

Aurora ransomware targets German law firm Rechtsanwaltskanzlei Dr. Bien

Aurora ransomware claims Infomedia A/S breach

Aurora ransomware claims Thomas Y. Pickett & Co., Inc.

Aurora ransomware claims breach of Laboratorios Roemmers SAICF

Aurora ransomware publishes Buford-Thompson Company data

Aurora ransomware publishes Jinny Beauty Supply breach

Aurora ransomware gang publishes Benshaw, Inc. as victim

Aurora claims breach of Metrea LLC / Commuter Air Technology (US defense contractor)

Aurora ransomware gang publishes EDIF S.p.A. data

Aurora ransomware gang publishes Chip 1 Exchange breach

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10+ Targets

Aurora ransomware claims Ishbia & Gagleard, P.C. law firm

Aurora ransomware claims SCA Logistik & Fulfillment GmbH as victim

Aurora ransomware claims ERPIS LLC (ShipERP) victim

Aurora ransomware gang publishes Planungsgruppe M+M AG data

Aurora ransomware claims Natco Home Group victim

Aurora ransomware claims Lloyd Coils Europe victim

Aurora ransomware publishes FREYWILLE luxury jewelry breach

Aurora ransomware publishes GILDE Handwerk Macrander GmbH & Co. KG

Aurora ransomware targets US Installation Group, Inc.

Aurora ransomware publishes Van Eijck International Car Rescue data

Aurora publishes Evosys Laser GmbH data breach

Aurora ransomware claims Pyramid Analytics B.V. breach; ServiceNow acquisition target

Aurora ransomware gang publishes Bretford Manufacturing as victim

Aurora ransomware claims Primed Halberstadt Medizintechnik, German medical-device manufacturer

Aurora ransomware publishes Corporación Primax S.A. data