Loading threat actor…
Aurora is a ransomware and data-extortion threat group active by at least mid-2026. It has been publicly associated with intrusions against organizations in manufacturing, construction, health care, financial services, information technology, transportation and logistics, and retail-related businesses. Reported victims include organizations in the United States, the Netherlands, Germany, Great Britain, and Austria, indicating a multi-country victimology with a notable concentration in North America and Europe. Aurora’s operations are consistently described as ransomware incidents and data breaches, with multiple cases involving claims of large-scale theft of sensitive corporate information. Reported stolen data has included source code, database backups, employee records, payroll and accounting data, banking information, engineering and project files, policy and claims data, and other internal business records. This pattern supports the assessment that Aurora conducts exfiltration in addition to ransomware deployment and uses stolen data as part of its pressure strategy. Observed targeting suggests an opportunistic financially motivated actor rather than a state-directed espionage group. Victim organizations span industrial and enterprise environments, including manufacturers, insurers, software and analytics firms, medical-device companies, civil engineering contractors, and transportation-related businesses. Available reporting does not provide high-confidence detail on Aurora’s initial access methods, persistence mechanisms, privilege-escalation techniques, lateral movement, or malware tradecraft beyond its role as a ransomware operator conducting data theft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware group claimed or was reported as hitting Planungsgruppe M+M AG in a ransomware/data breach incident.
Conducting a ransomware attack against Lloyd Coils Europe, a manufacturing company.
A ransomware group identified as aurora is reported as targeting FREYWILLE in a ransomware incident.
Mentioned as a new entrant in quarterly rankings.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.