Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Active · #103 by victimsRansomware group

Aurora

As of Oct 19, 2026, Aurora has listed 51 confirmed victims on its leak site since Apr 17, 2026, 0.2% of all victims tracked by Brandefense. Its most targeted country is United States (45.1% of its victims) and its most targeted sector is Manufacturing.

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.

Also known asAurora RansomwareZorro RansomwareZorro
Is My Company Listed?Follow AuroraRequest IOC FeedTTPs, CVEs and malware →

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
51
Rank By Victims
#103
Last Leak-Site Post
Oct 19, 2026
Top Country
United States
Top Sector
Manufacturing

Victims Posted Per Month.

Aurora confirmed victims per month
MonthConfirmed victims
April 20269
May 20263
June 202611
July 20264
August 202610
September 20266
October 2026 (month in progress)8
Updated continuously · figures as of Oct 19, 2026

Latest Aurora Victims.

Search all 51 →
Latest confirmed leak-site victims claimed by Aurora
VictimCountryIndustryData claimedPosted
POWERsonic Industries Inc.CACanadaManufacturingNot stated
Adams Warehouse & Delivery, Inc.USUnited StatesTransportation and LogisticsNot stated
Estrategias BigMat S.L.U.ESSpainRetailNot stated
The Buckner Company, Inc.USUnited StatesEducation and ResearchNot stated
Rechtsanwaltskanzlei Dr. Bien
bien-rechtsanwaelte.de
DEGermanyLegal ServicesNot stated
Infomedia A/SINIndiaTechnologyNot stated

How They Operate.

Aurora's threat actor profile lists 1 malware and tools, with its targets and related actors.

TTPs, CVEs and malware →

Who Aurora Targets.

Sectors

  1. Manufacturing917.6%
  2. Transportation and Logistics917.6%
  3. Consulting611.8%
  4. Technology611.8%
  5. Construction47.8%

Countries

  1. USUnited States2345.1%
  2. DEGermany917.6%
  3. CACanada47.8%
  4. NLNetherlands35.9%
  5. ATAustria23.9%
Shares are of this group's confirmed victims.

History.


  1. First confirmed victim listed on its leak site

  2. First seen in Brandefense data

  3. Busiest month on record: 11 confirmed victims

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.