Loading threat actor…
Aur0ra is a Russian-speaking, financially motivated ransomware group active in 2026 that conducts double-extortion operations combining file encryption with threats to publish stolen data. Its identified targets span Belgium, Germany, the United Kingdom, Argentina, Italy, and the United States, including chemical-products manufacturers, industrial manufacturers, a pharmaceutical distributor, and other businesses. Russian-language use does not establish its country of origin or a state affiliation. Aur0ra has gained initial access through high-volume email bombing followed by vishing calls impersonating an IT helpdesk. Its operators have used Xray-core as a reverse command-and-control tunnel, disguising the software as legitimate update or connectivity components and configuring VLESS/REALITY with Chrome-like TLS characteristics. Persistence mechanisms include scheduled tasks and user-level registry autoruns. Observed intrusions involved extensive lateral movement using Windows networking and remote-management protocols, attempts to manipulate Active Directory privileges and Group Policy, and eventual control of a highly privileged administrator account. Defense-evasion measures include clearing Windows event logs, disabling Microsoft Defender protections, and timestomping tunneling binaries. The group deploys victim-specific ransomware and distributes it across network shares. Its locker encrypts files in place without changing filenames or adding extensions, supports configurable encryption and multithreading, and includes ESXi- and Hyper-V-related options. Operators delete volume shadow copies to impede recovery and maintain a data-leak site for extortion pressure. Aur0ra operators have also used Cursor AI agents to assist credential theft, password discovery and hash cracking, account takeover, network access, and exploitation tasks. Recovered operator conversations show repeated attempts to circumvent agent safeguards by falsely presenting malicious work as authorized security simulations and restarting conversations after refusals. The extent to which AI assistance enabled individual compromises has not been established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
27 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.