Aurora Ransomware Recovery: New 2026 Group Targeting Manufacturers and VMware ESXi

Aurora is a financially motivated ransomware operation that started posting victims on its leak site in April 2026. Public trackers counted about 33 victim claims by October 2026. It works as double extortion: data is stolen first, systems are encrypted, and victims who do not pay are listed on the leak site.

Its listings are mostly manufacturing companies, with Germany and other European countries as its core area and further victims in Canada, the Netherlands, Denmark and the USA. Researchers describe an affiliate model, with the core operators running the encryptor and leak site while affiliates break into the networks.

Do not confuse this group with other attacks that only share the name: "Aurora Technologies" was a victim of The Gentlemen, and "Aurora Health Management" was listed by the Insomnia group.

Reported intrusions include social engineering of the help desk to obtain access, and an attack on VMware ESXi hosts in which the operator used an AI coding agent to explore the environment before deploying the encryptor. Encrypting the ESXi hosts takes down every virtual machine on them at once: file servers, ERP and accounting systems and their databases.

No public decryptor exists for this group. Recovery without the key works from the parts of each file that were not encrypted: large files such as VMDK virtual disks, SQL Server and Oracle databases and backup files are often only partly encrypted, so virtual machines, tables and files can be rebuilt from the intact parts.

Isolate the affected hosts but do not wipe or reinstall the ESXi servers or delete the encrypted VMDK, database and backup files: they are what the data is recovered from. Copy them, keep the ransom note, and contact us for a free assessment. We recover encrypted ESXi and Hyper-V virtual machines, SQL Server and Oracle databases and Veeam backups with our own tools. No data, no charge.