Aurora
| Active
Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.
Victims
7
First Discovered
2026-04-29
victim
Last Discovered
2026-04-29
victim
Inactive Since
12
days
Avg Delay
8
days
Infostealer
14.3%
victims with domain
Countries
4
hit
Attack Velocity — Last 12 months
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Aur0ra Blog | Yes | 2026-05-11T05:38:09 | nginx |
u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion
|
Target
Top 5 Activity Sectors
- Business Services 2
- Healthcare 1
- Consumer Services 1
- Hospitality and Tourism 1
- Manufacturing 1
Top 5 Countries
-
United States
4
-
United Kingdom
1
-
Maldives
1
-
Canada
1
Heatmap
Ransom Notes (1)
YARA Rules (1)
Victims (7)
[health] Advanta Genetics LLC — a respected CLIA/CAP-accredited clinical toxicology and molecular di…
[design] Baresque Group — a respected commercial-interiors company headquartered in Perth, Australia…
[lvmh] Guest Passport Scans — 75,855 Files, 10 Years
The single largest data category: 75,855 passpo…
[law] Law Offices of Michael A. Freedman, P.A. (maflaw.com). The exfiltrated corpus is 579 GB used /…
[food, metal] Atlas Metal Industries Inc. — a privately held commercial-foodservice-equipment manufa…
[warehouse] Costa Solutions, LLC — a privately held managed-labor and warehousing company headquarte…
[insurance] Bayou Title, Inc. — the largest title insurance agent and closing/settlement services pr…