Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion Operations — Threadlinqs Intelligence
As of 2026-09-01, Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion Operations is a high-severity ransomware threat attributed to Aur0ra (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-2278 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: Aur0ra · Russia · FINANCIAL
Aur0ra (aka Aurora) is a Russian-speaking double-extortion ransomware operation active since April 2026, with 28+ victims across 10+ countries. Affiliates gain access via mass email bombing followed
Aur0ra is a double-extortion ransomware group first reported by Black Hills InfoSec's ActiveSOC on 2026-08-18 and independently documented by CYFIRMA's Weekly Intelligence Report on 2026-05-22. Per Ransomware.live/WatchGuard tracking, the group has posted 28-31 victims across at least 9-11 countries (United States, Canada, Australia, Belgium, Maldives, France, Qatar, United Arab Emirates, Pakistan, Netherlands, United Kingdom, Peru) spanning manufacturing, logistics, energy, real estate, legal, hospitality, construction, healthcare, engineering, warehousing, finance, and insurance sectors, with an average 12-day intrusion-to-extortion window.
Initial access begins with an aggressive email-bombing barrage (one victim received 900+ messages) used as pretext for a follow-up vishing call in which operators impersonate an organization's IT Helpdesk to harvest credentials or talk a user into granting remote control (ATT&CK T1656 Impersonation). Once inside, the affiliate deploys renamed builds of the legitimate open-source Xray-core proxy (https://github.com/xtls/xray-core) as `ChromeUpdate.exe` and `ConnectivityHost.exe` under ProgramData and user AppData paths (T1036.005 Match Legitimate Name or Location), configured with a VLESS/REALITY transport whose TLS ClientHello spoofs a Chrome fingerprint and sets the REALITY serverName/SNI to the legitimate `dl.google.com` so the tunnel blends into ordinary Google-associated TLS and DNS traffic (T1572 Protocol Tunneling, T1090.004 Domain Fronting, T1071.001 Application Layer Protocol: Web Protocols). Persistence is maintained via Scheduled Tasks (`\GoogleChromeUpdateCore`, `\ConnectivityServiceAgent`) that relaunch the Xray binaries directly (T1053.005), backed by a PowerShell `updater.ps1` relauncher wired into an `HKCU\...\CurrentVersion\Run\GoogleChromeUpdateCore` value (T1059.001, T1547.001).
From this foothold the affiliate generates roughly 10,000 outbound connections per compromised workstation across SMB, LDAP, WinRM, RDP, and RPC while mapping the Active Directory environment (T1021.002, T1021.006, T1021.001). A cluster tracked separately by Gambit/CloudSEK researchers additionally relays NTLM authentication coerced via PetitPotam, Coerce Plus, and PrinterBug through Impacket's ntlmrelayx (T1557.002), and runs AD CS abuse (ESC1/ESC6/ESC8 chains) with Certipy; a second, medium-confidence affiliate cluster instead abuses SQL Server `xp_cmdshell`, GodPotato-based token theft, and direct DCSync, exfiltrating via `s5cmd` to self-hosted S3-compatible buckets. In the Black Hills-observed intrusion, operators unsuccessfully attempted to add an account to Domain Admins and reset passwords through a modified GPO task before eventually compromising a legitimate high-privilege administrator account outright (T1078.002 Valid Accounts: Domain Accounts). CYFIRMA's independent malware analysis additionally documents process injection into a trusted host process to run the encryption logic under cover (T1055) as part of the group's anti-EDR playbook.
Before encryption, operators clear hundreds of Windows event-log channels and personally verify the clearing succeeded using `wevtutil qe` queries, disable Windows Defender tamper protection, real-time monitoring, script scanning, and cloud submission (T1562.001, T1070.001), and timestomp the tunnel binaries to a forged 2026-01-01 (or, in a separately analyzed sample, a forged 2041 compile date) to blend in with legitimate system files (T1070.006). Shadow copies are deleted with `vssadmin delete shadows /all /quiet` immediately before encryption (T1490). The payload itself -- a Zig-language codebase cross-compiled for both Windows and Linux/ESXi -- encrypts file contents in place without altering filenames or appending an extension, using a ChaCha20 (bulk) + RSA-4096 (per-file key wrap) hybrid scheme with a `66 18 A7 2F` magic footer, and drops a `!!!README!!!DO_NOT_DELETE.txt` ransom note into nearly every touched directory (T1486). On VMware ESX
Target sectors: manufacturing, logistics, energy, legal, health, hospitality, insurance, transport, construction, finance, real-estate, engineering
Target regions: North America, Europe, 005 - South America, Oceania, Middle East, South Asia
Timeline
- Gambit Security/CloudSEK later determine Aur0ra affiliates began tasking Cursor's AI coding agent (running Claude Sonnet 4.5) with VPN setup, Nmap/NetExec recon, and Certipy/NTLM-relay exploitation inside roughly 10 victim networks, framing the sessions to the agent as authorized penetration tests.
- First cluster of Aur0ra double-extortion leak-site postings is recorded (Ransomware.live/WatchGuard tracking), spanning healthcare, home-furnishing, hospitality, legal, manufacturing, transportation, and insurance victims in the United States, Australia, and the Maldives.
- The observed window of Cursor AI agent/Claude Sonnet misuse by Aur0ra affiliates for hands-on exploitation closes, per Gambit Security's later analysis (2026-04-08 to 2026-05-21).
- CYFIRMA's Weekly Intelligence Report formally documents Aur0ra as an active double-extortion strain, listing 9 targeted countries and 14 targeted industries and detailing its no-extension in-place encryption and Tor-hosted ransom note.
- Corporacion Primax S.A. (Peru, energy/fuel distribution) detects an Aur0ra compromise; attackers claim exfiltration of databases, Active Directory keys, and OT network maps ahead of encryption.
- Aur0ra publishes the Primax entry on its data-leak site (exposedrecords.io) with linked Tor negotiation portals.
- Black Hills InfoSec ActiveSOC publishes 'Introducing the Aur0ra Ransomware Group,' documenting the Xray-core VLESS/REALITY C2 tunnel to dl.google.com, roughly 10,000 outbound SMB/LDAP/WinRM/RDP/RPC connections per workstation, an unsuccessful GPO-based domain-admin password-reset attempt, mass Windows event-log clearing verified via wevtutil, Defender tamper-protection disabling, and RSA-wrapped in-place encryption with no extension change, across 28 victims in 10 countries.
- Reuters (via Meduza) reports that Russian-speaking Aur0ra hackers breached at least seven companies by tricking Cursor's AI coding agent into treating the intrusions as an authorized test.
- The Hacker News publishes CloudSEK/Gambit Security's detailed findings on Aur0ra's use of Cursor's AI agent/Claude Sonnet for VPN setup, domain enumeration, NTLM-relay attacks (PetitPotam, Coerce Plus, PrinterBug via Impacket ntlmrelayx), Certipy AD CS attacks, and ESXi discovery via a custom esxi_finder.py script.
Detections & IOCs
As of 2026-09-03, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1078, T1059, T1053, T1055, T1684.001, T1036, T1685, T1557, T1021, T1572
