AURORA Ransomware Gang: Surge in DACH/US Sector Targeting — Critical CVE Exploitation & Detection Logic

Aliases: No confirmed aliases currently active; distinct from older defunct groups utilizing similar naming.

Operational Model: Current intelligence suggests a closed-group operation or a highly selective RaaS (Ransomware-as-a-Service) model given the precise targeting of high-value entities in the DACH region and US.

Ransom Demands: Historical analysis indicates demands ranging from $500k to $5M USD, scaling with victim revenue.

Initial Access: AURORA aggressively exploits internet-facing infrastructure. The recent campaign indicates a heavy reliance on exploiting remote access and perimeter management tools, specifically targeting vulnerabilities in ConnectWise ScreenConnect, Check Point Security Gateways, and Cisco FMC.

Tactics: Double extortion is standard practice. The group exfiltrates sensitive intellectual property and operational data before encryption. Average dwell time is estimated at 3-7 days, likely focused on data staging and credential dumping.

Current Campaign Analysis

Sector Targeting: AURORA has shifted focus heavily towards Manufacturing (Evosys Laser, Bretford) and Technology (Pyramid Analytics), with secondary interest in Transportation (Van Eijck). This suggests a priority on supply chain disruption and IP theft.

Geographic Concentration: There is a distinct clustering in Western Europe, specifically the Netherlands (NL) and Germany (DE), alongside a continued presence in the United States (US).

Observed Posting Frequency: The group demonstrates a high operational tempo, posting 4 victims within a 48-hour window (July 29-30). This frequency often correlates with the successful exploitation of a specific vulnerability before patches are widely applied.

CVE & Initial Access Vector Correlation: This campaign is strongly correlated with the active exploitation of the following CISA KEVs:

• CVE-2024-1708 (ConnectWise ScreenConnect): Allows remote code execution; likely used for initial access in tech environments utilizing remote support tools.
• CVE-2026-50751 (Check Point Security Gateway): Improper authentication in IKEv1; a probable vector for breaching the network perimeter of the manufacturing targets.
• CVE-2023-21529 (Microsoft Exchange): Used for internal persistence or credential harvesting via deserialization attacks.

Detection Engineering

SIGMA Rules

title: Potential AURORA ScreenConnect Exploitation Attempt
id: 8a7b9c1d-0e1f-2a3b-4c5d-6e7f8a9b0c1d
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect via suspicious URI paths
status: experimental
date: 2026/08/01
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Bin/ScreenConnect.'
            - 'WebService.asmx'
            - 'Host.ashx'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: critical
---
title: AURORA Lateral Movement via WMI
id: b2c3d4e5-1f2a-3b4c-5d6e-7f8a9b0c1d2e
description: Detects lateral movement patterns consistent with AURORA operators using WMI for remote execution
status: experimental
date: 2026/08/01
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        CommandLine|contains:
            - 'process call create'
    condition: selection
falsepositives:
    - Administrative scripting
level: high
---
title: AURORA Check Point IKE Anomaly
id: c3d4e5f6-2a3b-4c5d-6e7f-8a9b0c1d2e3f
description: Detects potential exploitation of CVE-2026-50751 via IKEv1 anomalies on Check Point gateways
status: experimental
date: 2026/08/01
author: Security Arsenal Research
logsource:
    category: firewall
detection:
    selection:
        dst_port: 500
        protocol: 'UDP'
    filter:
        action: 'accept'
    condition: selection and not filter
falsepositives:
    - High volume legitimate VPN traffic
level: medium

KQL (Microsoft Sentinel)

Hunts for process execution patterns associated with the exploitation of ConnectWise ScreenConnect and subsequent credential dumping.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in ("powershell.exe", "cmd.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("ScreenConnect", "ConnectWise", "cw", "WebService.asmx")
| extend Account = InitiatingProcessAccountName
| project Timestamp, DeviceName, Account, ProcessCommandLine, FolderPath
| order by Timestamp desc

Rapid Response PowerShell Script

This script checks for signs of VSS shadow copy manipulation (common pre-encryption) and enumerates recently created scheduled tasks often used for persistence.

# AURORA Response Script - Check VSS and Scheduled Tasks
Write-Host "[+] Checking for recent VSS Shadow Copy Deletion..." -ForegroundColor Cyan
$vssEvents = Get-WinEvent -LogName Application -FilterXPath "*[System[(EventID=1)]] and *[EventData[Data[@Name='CommandName'] and (vssadmin delete shadows)]]" -ErrorAction SilentlyContinue
if ($vssEvents) { Write-Host "[!] ALERT: VSS deletion found." -ForegroundColor Red } else { Write-Host "[-] No VSS deletion events found." -ForegroundColor Green }

Write-Host "[+] Checking for Scheduled Tasks created in last 24 hours..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-24) }
if ($tasks) { 
    Write-Host "[!] ALERT: Recently created tasks:" -ForegroundColor Red
    $tasks | Select-Object TaskName, TaskPath, Date
} else { Write-Host "[-] No suspicious tasks found." -ForegroundColor Green }

Write-Host "[+] Checking for exposed RDP (Port 3389) listeners..." -ForegroundColor Cyan
$netstat = netstat -an | findstr ":3389" | findstr "LISTENING"
if ($netstat) { Write-Host "[!] WARNING: RDP is listening." -ForegroundColor Yellow } else { Write-Host "[-] RDP not listening." -ForegroundColor Green }


---

Incident Response Priorities

T-minus Detection Checklist (Pre-Encryption):

1. ScreenConnect Logs: Immediate audit of ScreenConnect_[Service].log for anonymous connection attempts or WebService.asmx errors.
2. Firewall Telemetry: Hunt for IKEv1 mismatch errors or abnormal UDP/500 traffic spikes on Check Point devices.
3. Exchange Logs: Review IIS logs for Ews/autodiscover anomalies or deserialization payload indicators.

Critical Assets for Exfiltration:

• Manufacturing: CAD files, proprietary schematics, ERP databases (SAP/Oracle).
• Technology: Source code repositories, customer PII databases, API keys.

Containment Actions (Order of Urgency):

1. Isolate: Disconnect internet-facing VPN concentrators and ScreenConnect servers from the internal network immediately if anomalous traffic is detected.
2. Revoke: Reset credentials for service accounts associated with the identified vulnerabilities (e.g., Exchange, VPN).
3. Block: Block inbound/outbound traffic to known AURORA C2 infrastructure (if available) and geographically restrict external access to management interfaces.

Hardening Recommendations

Immediate (24 Hours):

• Patch: Apply patches for CVE-2024-1708 (ScreenConnect), CVE-2026-50751 (Check Point), and CVE-2023-21529 (Exchange) immediately.
• Disable: Temporarily disable VPN IKEv1 if not strictly required for legacy support.
• MFA: Enforce MFA on all remote access gateways and administrative consoles.

Short-term (2 Weeks):

• Network Segmentation: Move remote access tools (ScreenConnect, VPNs) into an isolated DMZ with strict egress rules.
• EAA: Implement Enterprise Application Access (ZTNA) to replace direct VPN access where possible.
• Monitoring: Deploy specific detection rules for the CVEs listed above to all SIEM environments.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub