Skip to main content
Darkfield

Operator dossier

aurora is a ransomware operator currently active on public leak sites. Darkfield has indexed 21 public victims claimed by this operator between April 29, 2026 and June 30, 2026. Aurora is a recently emerged ransomware group first observed in April 2026, operating with apparent financial motivations through targeted attacks across multiple sectors. Given its recent emergence, limited public documentation exists regarding the group's specific country of origin or affiliations with established ransomware operations, though its targeting patterns suggest a professional operation potentially operating as an independent entity rather than a known Ransomware-as-a-Service model. The group has demonstrated a preference for attacking business-critical sectors including business services, consumer services, manufacturing, healthcare, and financial services, with documented attacks spanning the United States, Canada, the Maldives, and Great Britain, though specific initial access vectors and technical methodologies remain undocumented by major threat intelligence firms. With only seven known victims documented since April 2026, Aurora represents a relatively small-scale operation compared to established ransomware families, though its cross-sector targeting approach and international victim scope indicate deliberate selection criteria rather than opportunistic attacks. The group remains active as of current reporting, though the limited victim count and recent emergence suggest either a highly selective targeting approach or a nascent operation still developing its operational capabilities.

Most-targeted sectors

Most-affected countries

Recent disclosures by aurora

All 21 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for aurora →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

aurora

21 victims indexed · first seen 3 months ago · last activity 15 days ago

21
Victims indexed
#157 of 364 tracked operators
2m
Active period
Apr 2026 → Jun 2026
4
Countries hit
top US · 4

At a glance

Status
active
First seen
3 months ago
Last activity
15 days ago
Primary sector
Business Services · 2 hits

About

Aurora is a recently emerged ransomware group first observed in April 2026, operating with apparent financial motivations through targeted attacks across multiple sectors. Given its recent emergence, limited public documentation exists regarding the group's specific country of origin or affiliations with established ransomware operations, though its targeting patterns suggest a professional operation potentially operating as an independent entity rather than a known Ransomware-as-a-Service model. The group has demonstrated a preference for attacking business-critical sectors including business services, consumer services, manufacturing, healthcare, and financial services, with documented attacks spanning the United States, Canada, the Maldives, and Great Britain, though specific initial access vectors and technical methodologies remain undocumented by major threat intelligence firms. With only seven known victims documented since April 2026, Aurora represents a relatively small-scale operation compared to established ransomware families, though its cross-sector targeting approach and international victim scope indicate deliberate selection criteria rather than opportunistic attacks. The group remains active as of current reporting, though the limited victim count and recent emergence suggest either a highly selective targeting approach or a nascent operation still developing its operational capabilities.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-04-01T00:00:00+00:00 · 7
2026-04-01T00:00:00+00:002026-04-01T00:00:00+00:00

Top countries

🇺🇸 United States
4
🇨🇦 Canada
1
Maldives
1
🇬🇧 United Kingdom
1
United States dossier →Canada dossier →Maldives dossier →United Kingdom dossier →

Top sectors

Business Services
2
Consumer Services
1
Manufacturing
1
Healthcare
1
Financial Services
1
Hospitality and Tourism
1
Business Services dossier →Consumer Services dossier →Manufacturing dossier →Healthcare dossier →

MITRE ATT&CK

5 techniques · 5 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1112Modify Registry
  • T1083File and Directory Discovery
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 15 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time aurora posts a victim.

Add aurora to your watchlist — Pro pings you within 5 minutes of any new aurora leak-site post, Telegram callout, or affiliate-rebrand inference.