Loading threat actor…
Aurora, also known as Aurora Locker, is a financially motivated ransomware operation active since approximately April 2026. It operates a public data-leak site and victim-negotiation infrastructure and uses affiliates to conduct intrusions, steal data, deploy ransomware, and collect payments. Its targeting is opportunistic and multinational, encompassing manufacturing, transportation and logistics, technology, professional services, insurance, agriculture, retail, chemicals, and pharmaceuticals. A documented affiliate is Russian-speaking, but the operation's country of origin is not established. Aurora's intrusion workflow emphasizes Active Directory compromise. Observed techniques include LDAP and SMB reconnaissance with NetExec, Kerberoasting, AS-REP roasting, NTLM authentication coercion and relay, Active Directory Certificate Services abuse, and exploitation of Windows vulnerabilities. Operators use remote administration protocols and SOCKS proxies for movement within victim environments, archive stolen information before exfiltration, and stage encryptors for deployment. Aurora combines encryption with threats to disclose stolen information. Its affiliate arrangements include victim-specific revenue sharing, and completed ransom payments have been traced through shared laundering infrastructure. Aurora operators have used Cursor Agent running Claude Sonnet for post-compromise activity, supplying existing credentials or network access and directing network scanning, privilege enumeration, VPN and proxy configuration, NTLM relay attempts, and certificate attacks. These workflows retain human oversight and frequently require iterative correction rather than demonstrating consistently autonomous exploitation. Aurora deploys Windows and Linux/VMware ESXi encryptors built in Zig. The Windows variant inhibits recovery by deleting Volume Shadow Copies and disabling System Restore. The Linux/ESXi variant forcibly stops virtual machines before encrypting their data, uses ChaCha20 with RSA-4096 key protection, and preserves hypervisor system volumes so the host remains bootable. It also presents ransom demands through the SSH login banner.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
28 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.