Aur0ra Ransomware Uses Helpdesk Vishing, AD Compromise, and Double Extortion

The Aur0ra/Aurora Locker ransomware operation has been linked to double-extortion attacks beginning with email bombing and vishing calls impersonating IT helpdesks. In one investigated intrusion, operators used renamed Xray-core binaries as reverse command-and-control tunnels, configured with VLESS/REALITY traffic masquerading as Chrome connections to dl.google.com; they then moved laterally, obtained privileged administrative access, cleared logs, weakened Microsoft Defender, and timestomped the tunnel binaries. The attackers deleted shadow copies, deployed a victim-specific locker and dist.exe distributor, and left !!!README!!!DO_NOT_DELETE.txt notes; encrypted files retained their original names and extensions but received a footer containing magic bytes 66 18 a7 2f.

Reporting indicates Aurora affiliates conduct the full attack lifecycle rather than solely brokering initial access, including credential theft, Active Directory compromise, data exfiltration, encryptor staging, extortion, and payment collection. Blockchain tracing identified two confirmed ransom payments and two more consistent with victim payments, routed through shared laundering and consolidation infrastructure before cash-out. The affiliate is assessed as Russian-speaking and opportunistically targets organizations outside the CIS; compensation appears individually negotiated rather than governed by a fixed ransomware-as-a-service split. On ESXi/Linux systems, Aurora has also modified the SSH banner configuration to display ransom demands instead of dropping a conventional ransom-note file.