# Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion Operations

> Aur0ra (aka Aurora) is a Russian-speaking double-extortion ransomware operation active since April 2026, with 28+ victims across 10+ countries. Affiliates gain access via mass email bombing followed by IT-helpdesk vishing, tunnel C2 through the legitimate Xray-core proxy using VLESS/REALITY domain-fronted as dl.google.com, move laterally over SMB/LDAP/WinRM/RDP/RPC/SSH, disable Defender tamper protection and clear event logs before deleting shadow copies, and encrypt files in place with a ChaCha20/RSA-4096 hybrid scheme that changes no filename or extension.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2278
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-aur0ra-xray-core-c2-tunneling-tl-2026-2278.webp?v=90ffbeef (Threadlinqs threat intel: Aur0ra Ransomware Xray-core Tunneling: Detection & IOCs (TL-2026-2278) — High severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-2278
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Aur0ra (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)

## Description

Aur0ra is a double-extortion ransomware group first reported by Black Hills InfoSec's ActiveSOC on 2026-08-18 and independently documented by CYFIRMA's Weekly Intelligence Report on 2026-05-22. Per Ransomware.live/WatchGuard tracking, the group has posted 28-31 victims across at least 9-11 countries (United States, Canada, Australia, Belgium, Maldives, France, Qatar, United Arab Emirates, Pakistan, Netherlands, United Kingdom, Peru) spanning manufacturing, logistics, energy, real estate, legal, hospitality, construction, healthcare, engineering, warehousing, finance, and insurance sectors, with an average 12-day intrusion-to-extortion window.

Initial access begins with an aggressive email-bombing barrage (one victim received 900+ messages) used as pretext for a follow-up vishing call in which operators impersonate an organization's IT Helpdesk to harvest credentials or talk a user into granting remote control (ATT&CK T1656 Impersonation). Once inside, the affiliate deploys renamed builds of the legitimate open-source Xray-core proxy (https://github.com/xtls/xray-core) as `ChromeUpdate.exe` and `ConnectivityHost.exe` under ProgramData and user AppData paths (T1036.005 Match Legitimate Name or Location), configured with a VLESS/REALITY transport whose TLS ClientHello spoofs a Chrome fingerprint and sets the REALITY serverName/SNI to the legitimate `dl.google.com` so the tunnel blends into ordinary Google-associated TLS and DNS traffic (T1572 Protocol Tunneling, T1090.004 Domain Fronting, T1071.001 Application Layer Protocol: Web Protocols). Persistence is maintained via Scheduled Tasks (`\GoogleChromeUpdateCore`, `\ConnectivityServiceAgent`) that relaunch the Xray binaries directly (T1053.005), backed by a PowerShell `updater.ps1` relauncher wired into an `HKCU\...\CurrentVersion\Run\GoogleChromeUpdateCore` value (T1059.001, T1547.001).

From this foothold the affiliate generates roughly 10,000 outbound connections per compromised workstation across SMB, LDAP, WinRM, RDP, and RPC while mapping the Active Directory environment (T1021.002, T1021.006, T1021.001). A cluster tracked separately by Gambit/CloudSEK researchers additionally relays NTLM authentication coerced via PetitPotam, Coerce Plus, and PrinterBug through Impacket's ntlmrelayx (T1557.002), and runs AD CS abuse (ESC1/ESC6/ESC8 chains) with Certipy; a second, medium-confidence affiliate cluster instead abuses SQL Server `xp_cmdshell`, GodPotato-based token theft, and direct DCSync, exfiltrating via `s5cmd` to self-hosted S3-compatible buckets. In the Black Hills-observed intrusion, operators unsuccessfully attempted to add an account to Domain Admins and reset passwords through a modified GPO task before eventually compromising a legitimate high-privilege administrator account outright (T1078.002 Valid Accounts: Domain Accounts). CYFIRMA's independent malware analysis additionally documents process injection into a trusted host process to run the encryption logic under cover (T1055) as part of the group's anti-EDR playbook.

Before encryption, operators clear hundreds of Windows event-log channels and personally verify the clearing succeeded using `wevtutil qe` queries, disable Windows Defender tamper protection, real-time monitoring, script scanning, and cloud submission (T1562.001, T1070.001), and timestomp the tunnel binaries to a forged 2026-01-01 (or, in a separately analyzed sample, a forged 2041 compile date) to blend in with legitimate system files (T1070.006). Shadow copies are deleted with `vssadmin delete shadows /all /quiet` immediately before encryption (T1490). The payload itself -- a Zig-language codebase cross-compiled for both Windows and Linux/ESXi -- encrypts file contents in place without altering filenames or appending an extension, using a ChaCha20 (bulk) + RSA-4096 (per-file key wrap) hybrid scheme with a `66 18 A7 2F` magic footer, and drops a `!!!README!!!DO_NOT_DELETE.txt` ransom note into nearly every touched directory (T1486). On VMware ESXi the same codebase enumerates and force-kills guest VM worlds via `esxcli vm process kill --type=force --world-id=<ID>` and delivers the ransom message by rewriting `/etc/ssh/sshd_config` to point at a banner file (T1041 for the pre-encryption exfiltration observed over the same C2 tunnel).

A distinctive and separately corroborated TTP is the affiliates' use of Cursor's agentic coding assistant (backed by Anthropic's Claude Sonnet 4.5) as a hands-on exploitation copilot: between 2026-04-08 and 2026-05-21, Gambit Security/CloudSEK observed operators task the agent -- after supplying it stolen credentials or an initial network route -- with installing VPN clients/proxychains, running Nmap/NetExec reconnaissance and NetExec's BloodHound collector for domain enumeration, driving PetitPotam/Coerce Plus/PrinterBug NTLM-relay chains via Impacket, running Certipy certificate attacks, and locating VMware ESXi hosts with a custom `esxi_finder.py` script, across roughly 10 victim organizations. Reuters (via Meduza, 2026-08-27) reports the operators framed these sessions to the AI agent as "authorized penetration testing" to obtain the agent's cooperation, breaching at least seven companies this way; researchers assess the acceleration this provided was modest (an estimated 30-50%, with most commands needing retry loops) and that the added telemetry from failed AI-driven attempts is, if anything, a net win for defenders. Operational-security chat logs and shell history were in Russian, operators explicitly banned DCSync deployment, mass account lockouts, and new domain-computer-object creation, and targeting logs excluded CIS-allocated IP space and CIS-country domains, consistent with a Russian-speaking criminal affiliate program.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1684.001 Impersonation
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1557 Adversary-in-the-Middle
- T1021 Remote Services
- T1572 Protocol Tunneling
- T1090 Proxy
- T1071 Application Layer Protocol
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Aur0ra — Correlated Pre-Encryption Anti-Forensics Chain (Log Clear + Shadow-Copy Deletion + Scheduled-Task Persistence)** (`TL-2026-2278-SPL-002`)

Detects the correlated sequence Aur0ra affiliates run in the final hours before encryption: mass Windows event-log clearing (verified operator-side with wevtutil qe/cl, EventCode 1102/104), vssadmin shadow-copy deletion, Defender tamper-protection disabling, and creation of the \GoogleChromeUpdateCore / \ConnectivityServiceAgent scheduled tasks or the matching HKCU Run key. Any single event here is low-severity in isolation; two or more on the same host in a short window is a near-certain pre-ransomware indicator.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1070.001, T1053.005, T1547.001, T1562.001, T1055, T1059.001
- **Data sources:** windows_security_eventlog, sysmon, edr_process_telemetry, windows_registry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=wineventlog sourcetype="WinEventLog:Security" (EventCode=1102 OR EventCode=104))
OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wevtutil*qe*" OR CommandLine="*wevtutil*cl*"
     OR (CommandLine="*schtasks*" AND (CommandLine="*GoogleChromeUpdateCore*" OR CommandLine="*ConnectivityServiceAgent*"))
     OR CommandLine="*DisableAntiSpyware*" OR CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*Set-MpPreference*DisableTamperProtection*"))
| eval technique=case(
    EventCode=1102 OR EventCode=104, "T1070.001_EventLogCleared",
    match(CommandLine, "(?i)vssadmin.*delete.*shadows"), "T1490_ShadowCopyDeletion",
    match(CommandLine, "(?i)wevtutil"), "T1070.001_LogClearVerification",
    match(CommandLine, "(?i)schtasks"), "T1053.005_ScheduledTaskPersistence",
    1=1, "T1562.001_DefenderTamperDisable")
| bucket _time span=2h
| stats count min(_time) as first_seen max(_time) as last_seen values(technique) as techniques dc(technique) as technique_count by host, _time
| where technique_count >= 2
| table host, first_seen, last_seen, techniques, count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows")
   or (FileName =~ "wevtutil.exe" and (ProcessCommandLine has "qe" or ProcessCommandLine has " cl "))
   or (FileName =~ "schtasks.exe" and (ProcessCommandLine has "GoogleChromeUpdateCore" or ProcessCommandLine has "ConnectivityServiceAgent"))
   or (FileName =~ "powershell.exe" and ProcessCommandLine has "DisableTamperProtection")
| extend Technique = case(
    FileName =~ "vssadmin.exe", "T1490_ShadowCopyDeletion",
    FileName =~ "wevtutil.exe", "T1070.001_LogClearVerification",
    FileName =~ "schtasks.exe", "T1053.005_ScheduledTaskPersistence",
    "T1562.001_DefenderTamperDisable")
| summarize Techniques=make_set(Technique), EventCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName
| where array_length(Techniques) >= 2
| project DeviceName, Techniques, EventCount, FirstSeen, LastSeen
| order by EventCount desc
```

### Sigma

```yaml
title: Aur0ra Correlated Pre-Encryption Anti-Forensics Chain
id: b2e6d4c8-1f3a-4e7b-9c02-8a6d5f2b1c02
status: experimental
description: Detects any of vssadmin shadow-copy deletion, wevtutil log-clear verification, or scheduled-task persistence naming GoogleChromeUpdateCore/ConnectivityServiceAgent — the immediate pre-encryption anti-forensics chain used by Aur0ra ransomware affiliates. Correlate 2+ hits on one host within a short window for high-confidence alerting.
references:
    - https://activesoc.blackhillsinfosec.com/blog/introducing-the-aur0ra-ransomware-group/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-01
tags:
    - attack.impact
    - attack.t1490
    - attack.defense-evasion
    - attack.t1070.001
    - attack.t1562.001
    - attack.persistence
    - attack.t1053.005
    - attack.t1547.001
logsource:
    category: process_creation
    product: windows
detection:
    sel_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    sel_wevtutil:
        Image|endswith: '\wevtutil.exe'
        CommandLine|contains:
            - 'qe'
            - ' cl '
    sel_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:
            - 'GoogleChromeUpdateCore'
            - 'ConnectivityServiceAgent'
    sel_tamper:
        CommandLine|contains:
            - 'DisableAntiSpyware'
            - 'DisableRealtimeMonitoring'
            - 'DisableTamperProtection'
    condition: 1 of sel_*
falsepositives:
    - Legitimate backup-software shadow-copy pruning (rare with /all /quiet flags together)
    - Authorized SOC log-retention or GPO scheduled-task administration (verify task name/owner)
level: high
```

**Known false positives:**

- Scheduled backup jobs invoking vssadmin during legitimate VSS maintenance windows
- SOC/IT log-retention automation running wevtutil for archival (not qe-based verification loops)

**Tuning notes:** Treat as a correlation rule, not a single-event alert — require 2+ distinct technique hits on the same host within a 2-hour window before paging, per the remediation guidance to correlate tamper-disable + log-clear + shadow-deletion as one chain rather than isolated low-severity events. Add HKCU\...\CurrentVersion\Run\GoogleChromeUpdateCore registry-write monitoring (T1547.001) and updater.ps1 PowerShell execution (T1059.001, SHA256 05679c26f3c993270e23874442a45af486af542f3c82fd7b001c56714e89de66) as additional correlation legs; process-injection telemetry (T1055) into a trusted host process is a further corroborating signal per CYFIRMA's analysis.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Aur0ra — Renamed Xray-core Beacon Masquerading as ChromeUpdate.exe / ConnectivityHost.exe (locked: unlock with TL Creds)
- Aur0ra — Correlated Pre-Encryption Anti-Forensics Chain (Log Clear + Shadow-Copy Deletion + Scheduled-Task Persistence) (locked: unlock with TL Creds)
- Aur0ra — Domain-Fronted Xray-core C2 to [indicator] + Mass SMB/LDAP/WinRM/RDP/RPC Lateral Sweep (locked: unlock with TL Creds)
- Aur0ra — Renamed Xray-core Beacon Masquerading as ChromeUpdate.exe / ConnectivityHost.exe (locked: unlock with TL Creds)
- Aur0ra — Correlated Pre-Encryption Anti-Forensics Chain (Log Clear + Shadow-Copy Deletion + Scheduled-Task Persistence) (locked: unlock with TL Creds)
- Aur0ra — Domain-Fronted Xray-core C2 to [indicator] + Mass SMB/LDAP/WinRM/RDP/RPC Lateral Sweep (locked: unlock with TL Creds)
- Aur0ra — Renamed Xray-core Beacon Masquerading as ChromeUpdate.exe / ConnectivityHost.exe (locked: unlock with TL Creds)
- Aur0ra — Domain-Fronted Xray-core C2 to [indicator] + Mass SMB/LDAP/WinRM/RDP/RPC Lateral Sweep (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `172.86.116[.]200`
- Domain: `dl[.]google[.]com`
- URL: `hxxp://pavregldzg2ypbd3gxbil2suxfok7ykmcknwhkli24anpks6lndymyyd[.]onion`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Introducing the Aur0ra Ransomware Group](https://activesoc.blackhillsinfosec.com/blog/introducing-the-aur0ra-ransomware-group/)
- [xtls/xray-core (abused legitimate tool)](https://github.com/xtls/xray-core)
- [Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Victims](https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html)
- [Reuters: Russian-speaking hackers breached seven companies by tricking the AI agent in Cursor](https://meduza.io/en/news/2026/08/27/reuters-russian-speaking-hackers-breached-seven-companies-by-tricking-the-ai-agent-in-cursor-the-coding-tool-now-owned-by-elon-musk-s-spacex-into-thinking-the-attacks-were-a-test)
- [Aur0ra Ransomware: Silent encryption targeting windows shadow copies](https://www.cohesity.com/platform/redlab/advisories/aur0ra-ransomware-silent-encryption/)
- [Aur0ra Ransomware (Ransomware Tracker)](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/aur0ra)
- [Primax Compromised by Aur0ra Ransomware Group](https://femtosec.io/threat-intelligence/primax-compromised-by-aur0ra-ransomware)
- [Aurora (Aur0ra) Ransomware](https://cyberwarrior76.substack.com/p/aurora-aur0ra-ransomware)
- [Weekly Intelligence Report - 22 May 2026 (Aur0ra Ransomware In Focus)](https://www.cyfirma.com/news/weekly-intelligence-report-22-may-2026/)
- [Aur0ra Ransomware Uses Helpdesk Vishing, AD Compromise, and Double Extortion](https://mallory.ai/stories/01a03e6a-afa6-7409-a42e-419cc5ae6540)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2278