Threat Group Profile
aurora
● Active — last 30 days
Victim claims
21
First seen
Apr 2026
Last activity
30 Jun 2026
Tracked since
—
Group overview
Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.
Preferred targets
Manufacturing · 5
Business Services · 5
Healthcare · 2
Financial Services · 2
Transportation/Logistics · 2
Construction · 1
Most targeted countries
US · 6
DE · 4
CA · 3
PE · 1
NL · 1
AU · 1
