Ransomware group
Aurora
Aurora is a ransomware operation tracked by ransomware.live.
Profile source: Ransomware.live opens in a new tabAurora
Family profile
Aurora is a ransomware operation tracked by ransomware.live. It is a separate family from the credential-stealing malware tracked as Aurora Stealer.
Ransomware.live
Operational record
Ransomware.live
Recent claims
Reporting
Research mentioning Aurora
Mar 14
Breakglass Intel
RUGMI/IDAT Loader + Aurora Stealer - Multi-Stage DLL Sideloading Campaign - Breakglass Intelligence - Breakglass Intelligence
This sample is a fully decrypted Stage 4 payload from the RUGMI/HijackLoader (also tracked as IDAT Loader) pay-per-install malware ecosystem, delivering an Aurora Stealer infostealer as the final payload.
Feb 2
Spamhaus
A surge of malvertising across Google Ads is distributing dangerous malware
Spamhaus researchers have linked fake Nvidia domains with Aurora Stealer and Vidar malware.
