aurora
First seen April 29, 2026Active52 claimed victims
The claims below are reproduced as posted by aurora on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Allmand-Smith Limited | October 22, 2026 | ransomlook | — |
| Duarte Nursery, Inc. | October 20, 2026 | ransomlook | — |
| POWERsonic Industries Inc. | October 19, 2026 | ransomlook | — |
| Adams Warehouse & Delivery, Inc. | October 16, 2026 | ransomlook | — |
| Estrategias BigMat S.L.U. | October 14, 2026 | ransomlook | — |
| The Buckner Company, Inc. | October 13, 2026 | ransomlook | — |
| Rechtsanwaltskanzlei Dr. Bien | October 12, 2026 | ransomlook | — |
| Infomedia A/S | October 5, 2026 | ransomlook | — |
| Thomas Y. Pickett & Co., Inc. | October 5, 2026 | ransomlook | — |
| Laboratorios Roemmers SAICF | October 1, 2026 | ransomlook | — |
| Buford-Thompson Company, LTD | September 30, 2026 | ransomlook | — |
| Jinny Beauty Supply | September 7, 2026 | ransomlook | — |
| Benshaw, Inc. | September 7, 2026 | ransomlook | — |
| Metrea LLC/Commuter Air Technology, Inc. | September 5, 2026 | ransomlook | — |
| EDIF S.p.A. | September 4, 2026 | ransomlook | — |
| Chip 1 Exchange | September 2, 2026 | ransomlook | — |
| Ishbia & Gagleard, P.C. | August 31, 2026 | ransomlook | — |
| Benshaw, Inc. | August 27, 2026 | ransomware_live | — |
| EDIF S.p.A. | August 27, 2026 | ransomware_live | — |
| SCA Logistik & Fulfillment GmbH | August 27, 2026 | ransomlook | — |
| ERPIS LLC | August 26, 2026 | ransomlook | — |
| Lloyd Coils Europe | August 17, 2026 | ransomware_live | — |
| Natco Home Group | August 17, 2026 | ransomware_live | — |
| Planungsgruppe M+M AG | August 17, 2026 | ransomware_live | — |
| FREYWILLE | August 11, 2026 | ransomware_live | — |
| US Installation Group, Inc. | August 4, 2026 | ransomware_live | — |
| GILDE Handwerk Macrander GmbH & Co. KG | August 4, 2026 | ransomware_live | — |
| Pyramid Analytics B.V. | July 30, 2026 | ransomware_live | — |
| Evosys Laser GmbH | July 30, 2026 | ransomware_live | — |
| Van Eijck International Car Rescue | July 30, 2026 | ransomware_live | — |
| Bretford Manufacturing | July 29, 2026 | ransomware_live | — |
| Primed Halberstadt Medizintechnik | June 30, 2026 | ransomware_live | — |
| Corporación Primax S.A. | June 23, 2026 | ransomware_live | — |
| NationsBuilders Insurance Services | June 22, 2026 | ransomware_live | — |
| Kochs GmbH | June 22, 2026 | ransomware_live | — |
| NTP B.V. Civil Engineering Construction | June 22, 2026 | ransomware_live | — |
| Aerospace & Advanced Composites GmbH | June 22, 2026 | ransomware_live | — |
| Hagerman & Company | June 19, 2026 | ransomware_live | — |
| Sumitomo Electric Bordnetze | June 16, 2026 | ransomware_live | — |
| Diamond Truck Centres | June 16, 2026 | ransomware_live | — |
| Allan Brothers Fruit | June 16, 2026 | ransomware_live | — |
| ALS Global | June 5, 2026 | ransomware_live | — |
| Avanti Windows & Doors | May 12, 2026 | ransomware_live | — |
| Bayou Title, Inc. | April 29, 2026 | ransomware_live | — |
| Costa Solutions, LLC | April 29, 2026 | ransomware_live | — |
| Atlas Metal Industries Inc | April 29, 2026 | ransomware_live | — |
| Law Offices of Michael A. Freedman, P.A. (maflaw.com) | April 23, 2026 | ransomware_live | — |
| NorthWest Handling Systems | April 23, 2026 | ransomware_live | — |
| Startec Group of Companies | April 23, 2026 | ransomware_live | — |
| Cheval Blanc Randheli | April 22, 2026 | ransomware_live | — |
| Baresque Group | April 22, 2026 | ransomware_live | — |
| Advanta Genetics LLC | April 17, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).