Operator dossier

AUR0RA is a ransomware operator currently active on public leak sites. Darkfield has indexed 6 public victims claimed by this operator between June 6, 2026 and June 15, 2026. AUR0RA is a ransomware group first observed in June 2026 with an apparent financial motivation, having claimed responsibility for attacks against at least five known victims across the United States, Canada, and Australia. Given the recency of the group's emergence and the limited number of confirmed victims, detailed public attribution from major threat intelligence organizations such as CISA, the FBI, or Mandiant has not yet been established, and as such claims regarding origin, affiliation, or operational infrastructure cannot be responsibly made at this time. The group's targeting pattern suggests a deliberate focus on mid-market industries including commercial interiors, real estate and title insurance, warehousing and material handling, manufacturing, and oil and gas and industrial manufacturing sectors, which may indicate an opportunistic selection strategy or a preference for organizations with potentially sensitive operational or financial data and limited cybersecurity maturity. No specific attack methodology, tooling, or extortion tactics have been publicly documented by reputable sources for this group as of the time of this writing, though the sector targeting profile is consistent with groups known to conduct double extortion operations. AUR0RA should be considered an emerging threat actor under active monitoring, with its current operational status assessed as active based on the recency of first observed activity and the absence of any publicly reported law enforcement disruption or disbandment.

Recent disclosures by AUR0RA

All 6 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for AUR0RA →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

AUR0RA

6 victims indexed · first seen 1 month ago · last activity 1 month ago

Victims indexed

#238 of 364 tracked operators

<1m

Active period

Jun 2026 → Jun 2026

—

Countries hit

At a glance

Status: active
First seen: 1 month ago
Last activity: 1 month ago
Onion sites: 1 known endpoint

About

AUR0RA is a ransomware group first observed in June 2026 with an apparent financial motivation, having claimed responsibility for attacks against at least five known victims across the United States, Canada, and Australia. Given the recency of the group's emergence and the limited number of confirmed victims, detailed public attribution from major threat intelligence organizations such as CISA, the FBI, or Mandiant has not yet been established, and as such claims regarding origin, affiliation, or operational infrastructure cannot be responsibly made at this time. The group's targeting pattern suggests a deliberate focus on mid-market industries including commercial interiors, real estate and title insurance, warehousing and material handling, manufacturing, and oil and gas and industrial manufacturing sectors, which may indicate an opportunistic selection strategy or a preference for organizations with potentially sensitive operational or financial data and limited cybersecurity maturity. No specific attack methodology, tooling, or extortion tactics have been publicly documented by reputable sources for this group as of the time of this writing, though the sector targeting profile is consistent with groups known to conduct double extortion operations. AUR0RA should be considered an emerging threat actor under active monitoring, with its current operational status assessed as active based on the recency of first observed activity and the absence of any publicly reported law enforcement disruption or disbandment.

Recent victims

Loading…

Onion infrastructure

1 known

http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time AUR0RA posts a victim.

Add AUR0RA to your watchlist — Pro pings you within 5 minutes of any new AUR0RA leak-site post, Telegram callout, or affiliate-rebrand inference.