Caught in 4K The Aurora Files
Caught in 4K: The Aurora Files
An exposed open directory revealed months of activity belonging to a Russian-speaking Aurora ransomware affiliate, active against more than twenty organizations between April and July 2026. The directory included the operator’s own toolkit and shell history alongside the Aurora encryptor itself, with the ransom note and onion address embedded directly in the binary. Four of the operator’s victims have since been listed on Aurora’s leak site. We assess with high confidence that the operator is a Russian-speaking Aurora affiliate operating directly, not a broker selling access onward.
The exposed directory provided a timestamped record of the operator’s activity spanning April to July 2026. The operator compromised more than twenty organizations across nine countries, achieving domain-level or interactive access at seventeen of them, four of which were later listed on Aurora’s public leak site. A key recovered from the operator’s own encryptor binary gave CloudSEK visibility into negotiations between the operator and a victim. In partnership with TRM Labs, CloudSEK traced the resulting payment on-chain. TRM’s independent analysis of Aurora’s broader on-chain footprint identified two confirmed victim payments and two further payments consistent with separate victims, all converging through a shared laundering network, rated high-moderate confidence.
The operator used Cursor, an agentic coding assistant, to plan attacks in Russian, while excluding CIS ranges and CIS-country domains, without exception. The Aurora encryptor itself is written entirely in Zig, an unusual language choice in this space. The discovered directory was the operator’s own Linux home directory, served without authentication from a file listing on port 8888. Kerberos tickets and credential material, SAM and LSA dumps, Group Policy exports, and BloodHound collections sat alongside the operator’s shell history, Cursor chat logs, and the Aurora encryptor itself. The ransom note embedded in that encryptor matches Aurora’s published note character for character. Every victim-facing action routed through a rented SOCKS pivot, mostly VPS providers in Germany and the US. The operator’s own infrastructure never touched a victim network directly. NetExec driven LDAP and SMB discovery, password policy retrieval, ASREPRoasting, Kerberoasting the same sequence, the same output.
Taken together, these findings place this operator well beyond the point where access simply becomes sellable: a repeatable AD-compromise playbook, an encryptor deployed under the operator’s own hand, and a payment trail that TRM Labs has now linked to more than one victim through shared laundering infrastructure.