Aurora

☆ pin

Reports

First seen

May 12, 2026

Last seen

Aug 11, 2026

Motivation

Financial

Targeting

Sectors

Manufacturing ×8 Retail & E-commerce ×3 Energy & Utilities ×2 Agriculture ×1 Technology ×1 Transport & Logistics ×1 Other ×1 Financial Services ×1

Victim regions

×1

×7

United States×7

Germany×5

Netherlands×3

Austria×2

Canada×2

Peru×1

Australia×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×2T1560 Archive Collected Data ×2T1005 Data from Local System ×2

Indicators

domain ×22

Indicator values are available on Pro and via the API.

Recent reports

High

Aurora ransomware claims Pyramid Analytics B.V. breach; ServiceNow acquisition target

ransomware.liveJul 30, 2026 High

Aurora ransomware gang publishes Bretford Manufacturing as victim

ransomware.liveJul 29, 2026 High

Aurora ransomware claims Primed Halberstadt Medizintechnik, German medical-device manufacturer

ransomware.liveJun 30, 2026 Critical

Aurora ransomware publishes Corporación Primax S.A. data

ransomware.liveJun 23, 2026 Critical

Aurora ransomware publishes Aerospace & Advanced Composites GmbH data

ransomware.liveJun 22, 2026 High

Aurora ransomware gang claims NTP B.V. Civil Engineering Construction as victim

ransomware.liveJun 22, 2026 Critical

Aurora ransomware gang publishes Kochs GmbH breach

ransomware.liveJun 22, 2026 High

Aurora ransomware gang claims NationsBuilders Insurance Services victim

ransomware.liveJun 22, 2026 Critical

Aurora ransomware gang publishes Hagerman & Company victim

ransomware.liveJun 19, 2026 Critical

Aurora ransomware gang claims breach of ALS Global, exfiltrates 20 GB+ of proprietary data

ransomware.liveJun 19, 2026 High

Aurora ransomware claims Allan Brothers Fruit as victim

ransomware.liveJun 16, 2026 High

Aurora ransomware gang publishes Diamond Truck Centres data

ransomware.liveJun 16, 2026 High

Aurora claims breach of Sumitomo Electric Industries subsidiary, exfiltrates 1.1 TB

ransomware.liveJun 16, 2026 Critical

Aurora ransomware publishes Avanti Windows & Doors breach

ransomware.liveMay 12, 2026 High

Aurora ransomware gang publishes Startec Group of Companies victim

ransomware.liveMay 12, 2026 Critical

Aurora ransomware publishes NorthWest Handling Systems data

ransomware.liveMay 12, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.