aurora

aurora is a ransomware group operating under an extortion model that threatens to leak stolen data, and it has demonstrated notable tradecraft such as leveraging SpaceX's Cursor AI tool to facilitate credential theft and other malicious activity. ThreatCluster has recorded about two dozen victims attributed to aurora, with hits across Manufacturing, Professional Services, Retail & E-Commerce, Business Services, and Technology, and the countries most affected are Germany, the United States, the Netherlands, Austria, and Peru. Recent reporting shows a pattern of using AI-enabled tools to breach targets and steal credentials, as illustrated by Aur0ra's use of SpaceX's Cursor AI tool to breach at least seven firms between April 8 and May 21, 2026.

Sectors: Manufacturing, Professional Services, Retail & E-Commerce · Countries: DE, US, NL