Aurora Ransomware Decryption & Data Recovery

Aurora - branded Aur0ra on its own leak site, with a zero in place of the letter o - surfaced in late April 2026. The earliest victim record on threat-intelligence trackers is dated 17 April 2026, the leak site was catalogued on 29 April, and 360's April 2026 ransomware landscape report lists Aur0ra among the new double-extortion families of that month - as a name only, with no technical analysis. By early September 2026 ransomware.live carried 39 victim entries, the most recent posted on 7 September; counts differ substantially between trackers (other analyses cite 28 and 33), so the real scale is best read as "several dozen" rather than an exact figure. By that tracker's breakdown, victims span 11 countries, led by the United States ahead of Germany, the Netherlands, Canada and the United Kingdom; manufacturing dominates by sector, followed by professional services, retail and e-commerce, and transport and logistics. Public analyses agree that the operation consistently excludes CIS address ranges and CIS-country domains.

In late August 2026 CloudSEK and Gambit Security published the contents of a misconfigured server belonging to an Aurora affiliate: more than twenty organisations across nine countries compromised between April and July 2026, domain-level or interactive access at seventeen of them, four eventually named on the leak site, and interactive use of an AI coding agent to assist hands-on exploitation against ten targets between 8 April and 21 May 2026. Ransom splits varied deal by deal, with the affiliate share reported at roughly 54-79% - a loose affiliate arrangement rather than a mature fixed-cut RaaS.

Public information remains limited. As of 11 September 2026 no CERT or law-enforcement advisory has been issued; the technical picture rests on a handful of private investigations that cover different, largely non-overlapping ground (initial access in one, encryptor reversing in another), several specifics rest on a single source, and victim counts vary by tracker. No public report documents a targeted campaign against mainland China organisations, but the access techniques and the target surface apply just as well here.

The defining oddity: filenames are not changed and no extension is appended. A file called 1.jpg is still called 1.jpg after encryption; the directory listing looks untouched and the damage only shows when something tries to open the data. Identification by extension - the normal first move - simply does not work here, and organisations routinely lose hours treating the event as an application or storage fault before recognising ransomware.

Ransom note. !!!README!!!DO_NOT_DELETE.txt, with the leading exclamation marks chosen to float it to the top of directory listings. The text is extremely short: confidential files have been downloaded, files are encrypted, contact us over Tor, followed by a per-victim access key.

Linux / ESXi. The encryptor writes no note file at all. The demand is placed in the SSH login banner, so an administrator only sees it at the next login to the host.

File trailer marker. Publicly analysed samples append a fixed magic value, 66 18 A7 2F, to encrypted files alongside the RSA-wrapped per-file key. This is currently one of the most reliable attribution signals.

Surrounding artefacts. Expect dist.exe (an SMB distributor), updater.ps1 (a persistence script) and an Xray-core proxy renamed to ChromeUpdate.exe or ConnectivityHost.exe. Observed encryptor filenames include sap.exe on Windows and encrypt.out on Linux/ESXi. These filenames and the trailer value come from a small number of public investigations, so treat them as corroborating signals to be checked against the actual samples rather than as a sole basis for attribution.

Email bombing plus help-desk vishing is the only initial-access technique documented in a published incident. Operators flood a target employee with 900 or more junk emails, then telephone posing as the IT help desk offering to fix the "mail problem", and talk the user into granting remote control. That first machine is won entirely outside the perimeter - no edge appliance is touched. Note that the other two published investigations do not record how initial access was obtained, so this should not be read as the family's only or inevitable route in.

Domain escalation chain. NetExec with custom LDAP/SMB discovery modules for enumeration, then custom noPac scripts, Certipy and Active Directory Certificate Services template abuse (ESC1 / ESC6 / ESC8), and Impacket ntlmrelayx fed by PetitPotam, PrinterBug or DFSCoerce coercion, to reach domain administrator. MS17-010 (EternalBlue) was used on at least one target. Lateral movement runs over SMB, LDAP, WinRM, RDP and RPC.

Hypervisor discovery. A purpose-built discovery module, esxi_finder.py, hunts for ESXi and vCenter - virtualisation is a planned objective, not an opportunistic extra.

Exfiltration and C2. PowerShell-driven 7-Zip archives data into 50GB chunks for transfer; command and control runs on Metasploit handlers with victim-facing traffic routed through rented SOCKS pivots on German and US VPS providers.

The time window. In the published records, the interval between the operator's access and the victim appearing on the leak site is as short as two weeks and never longer than a couple of months, with one analysis putting the median around twelve days. A detection window therefore genuinely exists; it simply tends to be lost in routine alerting. Note also that the published tooling includes a DCSync-equivalent capability, so do not assume domain credentials were left untouched - treat bulk credential theft as having happened.

Implementation. The encryptor is written in Zig, with two Windows variants and two Linux/ESXi variants built from one codebase.

Algorithms. On the asymmetric side each per-file symmetric key is wrapped with RSA-4096. For the symmetric cipher the only published reverse-engineering result covers the Linux variant and reports ChaCha20; the Windows variant has no public analysis of its symmetric implementation, so do not assume it matches - determine it from the sample in hand. Key material is never written in cleartext.

Partial encryption. Published command-line flags include -percent (the encryption ratio), -threads, -path, -f, -scanners, -noparallel, -extensions, -allowfolders and -esxi. Large files are therefore usually only partly overwritten, which leaves structural repair space in database files and virtual disks - but the actual ratio depends on the flags used in that specific attack and must be measured on the real files rather than assumed from the family.

Windows behaviour. Shadow copies are deleted, System Restore disabled, and the binary checks for a Hyper-V environment.

ESXi behaviour. The encryptor collects the World ID of every running virtual machine and force-kills the guests to release file locks, then encrypts vmdk, vmx, vmsd, vmsn, nvram, vmem, vswp and log files while deliberately skipping system volumes such as BOOTBANK* and OSDATA* so the host still boots and an administrator can still log in and read the banner.

Double extortion. Data is stolen before encryption, and the Aur0ra Blog leak site is served as a Tor hidden service. Published investigation puts roughly one in five confirmed victims on the leak site, the rest settled during negotiation.