Aurora
ObscureIQ Threat Intelligence · Actor Profile
AuroraConfidence: Medium
Ransomware
Motivation: Financial
1Attributed Breaches Circulating
MediumAttribution Confidence
RansomwareActor Type
Overview
Built on a Go-based malware family also sold as an infostealer/botnet named Aurora, distributed by multiple crews since mid-2022 and active into 2026 against law firms and manufacturing. Double extortion with a leak site; shared tooling complicates single-group attribution.
Tactics, Targeting & TTPs
Double extortion with a leak site; Aurora tooling also used for stealer/botnet activity, complicating single-group attribution.
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.