Aurora is a financially motivated ransomware group first observed in late May 2018, operating an affiliate-based model that utilizes a multi-purpose Go-based malware, also sold as an infostealer and botnet on underground forums. This group is distinct from "Operation Aurora," an earlier cyber-espionage campaign attributed to Chinese state-sponsored actors. The Aurora ransomware, also known by the aliases Animus and OneKeyLocker, encrypts victim files and demands Bitcoin payments. Its operational model has evolved to include the distribution of its Go-based malware by multiple criminal teams, enabling a broader range of illicit activities beyond typical ransomware encryption.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker