Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group Active in the last 30 days

Aurora ransomware

58 victims listed on the Aurora leak site across 16 countries. Most recent disclosure .

Victims
58
0.2% of all tracked
Countries
16
Most: United States
Sectors
14
Most: Manufacturing
First seen
Apr 2026
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Aurora and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Aurora is a ransomware and multi-purpose malware group reported to have infected 50 victims across 15 countries, targeting sectors like manufacturing, technology, and retail.

Who Aurora is

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.

Recorded activity

Disclosures attributed to Aurora in this database run from April 2026 to October 2026, totalling 58 victims — 0.2% of everything tracked here. Aurora has listed victims in 16 countries in this database, most often United States, followed by Germany and Netherlands. The sectors appearing most in its listings are Manufacturing, Retail & E-Commerce, Transportation.

YARA detection rules

aurora.yar 
/*
aurora ransomware
*/

rule aurora_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.aurora"
        description = "Detects aurora ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "aurora" ascii nocase
        $name2 = "AURORA" ascii
        $onion  = "aurora.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Aurora, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Aurora has disclosed 58 victims on its leak site, 0.2% of all ransomware listings tracked in this database. Its earliest disclosure here dates to April 2026.

The group has listed organisations in 16 countries, most often in United States (24 victims), followed by Germany, Netherlands, United Kingdom.

By industry, its listings concentrate in Manufacturing, Retail & E-Commerce, Transportation — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Aurora is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Aurora victims 58

Organization Disclosed
ARX Group SA
CHSwitzerland
Allmand-Smith Limited
GBUnited Kingdom
Duarte Nursery, Inc.
USUnited States
POWERsonic Industries Inc.
USUnited States
Adams Warehouse & Delivery, Inc.
USUnited States
Estrategias BigMat S.L.U.
ESSpain
The Buckner Company, Inc.
USUnited States
Rechtsanwaltskanzlei Dr. Bien
DEGermany
Infomedia A/S
DKDenmark
Infomedia A/S
DKDenmark
Thomas Y. Pickett & Co., Inc.
USUnited States
Laboratorios Roemmers SAICF
ARArgentina
Laboratorios Roemmers SAICF
ARArgentina
Buford-Thompson Company, LTD
USUnited States
Buford-Thompson Company, LTD
USUnited States
Benshaw, Inc.
USUnited States
Benshaw, Inc.
USUnited States
Jinny Beauty Supply
USUnited States
Jinny Beauty Supply
USUnited States
Metrea LLC/Commuter Air Technology, Inc.
USUnited States
Metrea LLC/Commuter Air Technology, Inc.
USUnited States
EDIF S.p.A.
ITItaly
Chip 1 Exchange
SGSingapore
Chip 1 Exchange
USUnited States
Ishbia & Gagleard, P.C.
USUnited States
SCA Logistik & Fulfillment GmbH
DEGermany
ERPIS LLC
Lloyd Coils Europe
GBUnited Kingdom
Natco Home Group
USUnited States
Planungsgruppe M+M AG
CHSwitzerland
FREYWILLE
ATAustria
GILDE Handwerk Macrander GmbH & Co. KG
DEGermany
US Installation Group, Inc.
USUnited States
Evosys Laser GmbH
DEGermany
Pyramid Analytics B.V.
NLNetherlands
Van Eijck International Car Rescue
NLNetherlands
Bretford Manufacturing
USUnited States
Primed Halberstadt Medizintechnik
DEGermany
Corporación Primax S.A.
PEPeru
Aerospace & Advanced Composites GmbH
DEGermany
Kochs GmbH
DEGermany
NationsBuilders Insurance Services
NTP B.V. Civil Engineering Construction
NLNetherlands
ALS Global
AUAustralia
Hagerman & Company
Allan Brothers Fruit
USUnited States
Diamond Truck Centres
CACanada
Sumitomo Electric Bordnetze
DEGermany
Avanti Windows & Doors
USUnited States
NorthWest Handling Systems
CACanada
Startec Group of Companies
PHPhilippines
Advanta Genetics LLC
USUnited States
Atlas Metal Industries Inc
CACanada
Baresque Group
GBUnited Kingdom
Bayou Title, Inc.
USUnited States
Cheval Blanc Randheli
MVMaldives
Costa Solutions, LLC
USUnited States
Law Offices of Michael A. Freedman, P.A. (maflaw.com)
USUnited States

Frequently asked questions

What is Aurora ransomware?

Aurora is a ransomware threat group that has claimed 58 victims since its first known activity in April 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Aurora attacked?

Aurora has claimed 58 victims in our database, representing 0.2% of all tracked ransomware attacks. The most targeted countries are United States, Germany, Netherlands, United Kingdom.

Which countries does Aurora target?

Aurora has attacked organizations in 16 countries. The top targeted countries are: United States, Germany, Netherlands, United Kingdom.

Which industries does Aurora target?

Aurora most frequently targets the Manufacturing, Retail & E-Commerce, Transportation sectors based on victim disclosures in our database.

Is Aurora still active?

Aurora's most recent victim disclosure in our database was on October 23, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.