The Aurora Files: Inside a High-Resolution Malware Investigation

Summary

A Russian-speaking Aurora ransomware affiliate has conducted extensive operations targeting more than twenty organizations. The attacker uses AI-assisted tools such as Cursor for attack planning and deploys custom Zig-based encryptors across Windows and Linux/ESXi environments. The campaign combines sophisticated lateral movement, ADCS exploitation, and a complex cryptocurrency laundering network.

Investigation

CloudSEK uncovered an exposed open directory associated with the operator that contained shell history, custom tooling, and credential material. Working with TRM Labs, investigators traced ransom payments on-chain and identified shared laundering infrastructure used across multiple victims. The investigation also revealed the use of an agentic coding assistant to generate exploitation plans written in Russian.

Mitigation

Organizations should disable LLMNR/NBT-NS, enforce SMB signing, and audit ADCS templates for ESC1, ESC6, and ESC8 misconfigurations. Backup infrastructure should be isolated from production Active Directory, and krbtgt credentials should be rotated following a suspected compromise. Monitoring for large-scale access to browser profile directories is also recommended to reduce credential theft risk.

Response

If Aurora activity is detected, organizations should immediately isolate affected systems and segment backup infrastructure. Incident responders should audit Active Directory Certificate Services and rotate highly privileged credentials, including the krbtgt account. Investigations should also identify unauthorized SSH configuration changes and unusual service restarts on Linux or ESXi hosts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained root access to an ESXi-like Linux environment. Their goal is to maximize psychological impact by ensuring the ransom note is the first thing a sysadmin sees. They execute a three-step sequence: first, they append a directive to /etc/ssh/sshd_config to point to a custom banner; second, they create the sshd-banner file containing the ransom text; third, they use the legacy init.d service manager to restart the SSH service, ensuring the changes take effect. This specific sequence is designed to be “loud” in its intent but “quiet” to signature-based AV that only looks for file writes.

• Regression Test Script:

  #!/bin/bash
  # Aurora Locker Simulation Script
  # This script mimics the specific command-line strings required to trigger the Sigma rule.
  
  echo "[+] Starting Aurora Locker Simulation..."
  
  # 1. Modify sshd_config (Selection: selection_config)
  echo "Banner /etc/ssh/sshd-banner" >> /etc/ssh/sshd_config
  echo "[*] Modified /etc/ssh/sshd_config"
  
  # 2. Create the banner file (Selection: selection_banner_file)
  echo "YOUR FILES ARE ENCRYPTED! PAY BTC TO..." > /etc/ssh/sshd-banner
  echo "[*] Created sshd-banner"
  
  # 3. Restart SSH using init.d (Selection: selection_restart)
  # Note: We use the exact strings 'init.d', 'SSH', and 'restart' to satisfy the 'all' condition.
  /etc/init.d/SSH restart
  echo "[*] Executed /etc/init.d/SSH restart"
  
  echo "[+] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  #!/bin/bash
  # Cleanup script to restore system state
  echo "[+] Cleaning up simulation artifacts..."
  
  # Remove the banner file
  rm -f /etc/ssh/sshd-banner
  
  # Revert sshd_config (Note: In a real environment, use sed or manual edit)
  # For simulation purposes, we will comment out the banner line
  sed -i '/Banner /etc/ssh/sshd-banner/d' /etc/ssh/sshd_config
  
  # Restart service normally to ensure access is maintained
  systemctl restart ssh
  
  echo "[+] Cleanup complete."