Ransomware group profile · #98 by claimed victims

Aurora ransomware

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.

Active First seen Apr 2026

56Victims claimed on leak sites

16Victims in the last 30 days

31Victims in the last 90 days

15Countries hit

3Leak-site URLs tracked, 1 online

30 Oct 2026Latest claim recorded

Victimology

Who Aurora claims to have breached, from 56 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing20

Professional Services11

Retail & E-Commerce6

Transportation5

Technology3

Healthcare3

Other3

Financial Services2

Top countries

United States21

Germany9

United Kingdom4

Netherlands3

Canada3

Italy2

Maldives1

Argentina1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Rapid Manufacturing	Manufacturing	-	30 Oct 2026
CP Manufacturing, Inc. cp manufacturing, inc.	Manufacturing	US	30 Oct 2026
EWM Group	Other	GB	28 Oct 2026
Meleghy Automotive & Cie. GmbH meleghy automotive & cie. gmbh	Manufacturing	DE	28 Oct 2026
GreenbergFarrow	Professional Services	-	27 Oct 2026
Ernesto Malvestiti S.p.A. ernesto malvestiti s.p.a.	Manufacturing	IT	26 Oct 2026
ARX Group SA	Other	CH	23 Oct 2026
Allmand-Smith Limited	Manufacturing	GB	21 Oct 2026
Duarte Nursery, Inc. duarte nursery, inc.	Agriculture and Food Production	US	20 Oct 2026
POWERsonic Industries Inc. powersonic industries inc.	Manufacturing	US	19 Oct 2026
Adams Warehouse & Delivery, Inc. adams warehouse & delivery, inc.	Transportation	US	16 Oct 2026
Estrategias BigMat S.L.U. estrategias bigmat s.l.u.	Retail & E-Commerce	ES	14 Oct 2026

All 56 Aurora victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Aurora is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Aurora ransomware still active?

Aurora is tracked as active. The most recent leak-site claim VULONE recorded is dated 30 October 2026. 16 victims were claimed in the last 30 days.

How many victims has Aurora claimed?

VULONE has recorded 56 leak-site victim claims attributed to Aurora since April 2026, across 15 countries and 10 sectors.

Which industries does Aurora target?

The sectors most often named on the Aurora leak site are Manufacturing, Professional Services, Retail & E-Commerce.

Which countries are most affected by Aurora?

Most Aurora victims recorded by VULONE are located in United States, Germany, United Kingdom.

Where does VULONE get Aurora victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.