Exposed Directory Reveals Aurora Affiliate’s Attacks on More Than 20 Organizations

Aug 27, 2026 · Original article ↗

Summary

CloudSek says an exposed directory revealed an Aurora affiliate’s activity against more than 20 organizations, including Active Directory compromises, Zig ransomware, AI-assisted planning, and payments traced through shared laundering infrastructure.

Key points

An unauthenticated directory exposed the operator’s Linux home folder, including shell history, Cursor chat logs, victim data, and Aurora encryptors; the activity spanned April to July 2026.
CloudSek reports the affiliate compromised more than 20 organizations across nine countries, gaining domain-level or interactive access at 17; four later appeared on Aurora’s leak site.
The operator used a repeated Active Directory compromise playbook, with credential theft and escalation involving certificate-service abuse and NTLM relay techniques.
The Windows and Linux/ESXi encryptors were written in Zig. The ESXi variant stops running virtual machines before encryption.
Recovered Cursor sessions show the operator using the AI coding assistant to plan attacks in Russian; the operator’s activity and targets also indicated avoidance of CIS ranges and domains.
CloudSek and TRM Labs traced two confirmed victim payments and two additional payments consistent with separate victims through shared laundering infrastructure.
The report includes file hashes, network indicators, a Sigma detection rule, and mitigation recommendations for Active Directory, credentials, and backup infrastructure.

Article Details

Attack Vectors: LDAP and SMB discovery with NetExec, including password-policy retrieval, AS-REP Roasting, and Kerberoasting.
Active Directory privilege escalation using a custom noPac chain and ADCS ESC1, ESC6, and ESC8 abuse.
NTLM relay attacks using PetitPotam, PrinterBug, and DFSCoerce; one toolkit included a DCSync variant.
EternalBlue (MS17-010) was used for remote code execution and direct account creation on one target.
PowerShell-driven 7-Zip archiving in 50 GB chunks was used to stage and pull exfiltrated data.
Aurora encryptors were transferred from a public Cloudflare R2 bucket to staging hosts using scp. The ESXi variant stopped running virtual machines before encryption.
The Windows encryptor deleted volume shadow copies, resized shadow storage, and disabled System Restore.
Defensive Notes: Disable LLMNR and NBT-NS, enable SMB signing and Extended Protection for Authentication, restrict WinRM to designated administrative hosts, and disable SMBv1, especially on domain controllers.
Audit ADCS templates for ESC1, ESC6, and ESC8 misconfigurations; remove ENROLLEE_SUPPLIES_SUBJECT or require CA Manager Approval where applicable, and audit certificate requests and issuance.
Where domain compromise is suspected, reset the krbtgt password twice with a full replication interval between resets, and alert on Kerberos tickets whose validity exceeds domain policy.
Review accounts with service principal names, remove SPNs from privileged accounts, migrate service accounts to group managed service accounts where supported, and enforce long, complex passwords elsewhere.
Enable browser credential-store encryption and monitor for bulk or scripted access to browser profile directories.
Isolate backup infrastructure, including Veeam and equivalent platforms, using separate credentials and network segments from production Active Directory.
Retire or isolate end-of-life operating systems, particularly hosts reachable over null-session SMBv1 without signing.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]194[.]134[.]167`	Operator VPS identified as a SOCKS relay.
IPV4	`144[.]172[.]116[.]150`	Operator VPS listed as an indicator.
IPV4	`167[.]88[.]167[.]37`	C2 egress-check indicator; the source lists port 50167.
IPV4	`172[.]86[.]113[.]245`	Operator VPS listed as an indicator.
IPV4	`172[.]86[.]90[.]75`	Operator VPS listed as an indicator.
IPV4	`23[.]234[.]108[.]48`	Rented SOCKS pivot used for victim-facing activity.
IPV4	`45[.]61[.]148[.]166`	Rented SOCKS pivot; the source lists port 21056.
IPV4	`89[.]106[.]83[.]49`	Rented SOCKS pivot used for victim-facing activity.
SHA256	`a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe`	SHA-256 of the Aurora Linux/ESXi locker encrypt.out.
SHA256	`eb0aab1e892d7e09e2c7bcf1d21fd83c1743ed9196b3efac6c78482fb0d99207`	SHA-256 of the Aurora Windows locker sap.exe.