Caught in 4K: The Aurora Files

MITRE Techniques

• [T1133 ] External Remote Services – Victim-facing actions were routed through rented SOCKS pivots and VPS infrastructure rather than direct access (‘Every victim-facing action routed through a rented SOCKS pivot’).
• [T1087 ] Account Discovery – The operator used LDAP and SMB discovery to enumerate users, hosts, and access paths (‘NetExec driven LDAP and SMB discovery’).
• [T1069 ] Permission Groups Discovery – BloodHound collections and AD enumeration were used to map privilege relationships (‘BloodHound collections sit alongside…’).
• [T1482 ] Domain Trust Discovery – Kerberos and AD reconnaissance supported domain-level targeting and escalation (‘Kerberos tickets and credential material remain in place’).
• [T1518 ] Software Discovery – The operator identified installed software and services, including Hyper-V and ESXi-related assets (‘check for a running Hyper-V management service’, ‘ESXi-discovery module’).
• [T1110.003 ] Password Spraying – Password policy retrieval and repeated access testing were part of the discovery workflow (‘password policy retrieval’).
• [T1110.004 ] Credential Stuffing – Cached credentials and validated credentials were used against services and accounts (‘SSL-VPN credentials validated’, ‘backup-system credentials validated’).
• [T1558.004 ] Kerberoasting – Service tickets were targeted for offline cracking (‘Kerberoasting the same sequence’).
• [T1558.004 ] AS-REP Roasting – Accounts without preauthentication were targeted for offline hash cracking (‘ASREPRoasting’).
• [T1098 ] Account Manipulation – The custom noPac chain used machine-account rename steps to escalate privileges (‘machine-account rename → TGT → S4U2self’).
• [T1550.003 ] Pass the Ticket – The noPac flow produced a TGT that was then used in subsequent privileged access (‘TGT → S4U2self’).
• [T1649 ] Steal or Forge Kerberos Tickets – Kerberos tickets were captured and abused for access (‘Domain-administrator Kerberos tickets captured’).
• [T1606.002 ] Forge Web Credentials – AD CS abuse was used to mint certificates for elevated access (‘Template misconfiguration → DA certificate’).
• [T1649 ] Steal or Forge Kerberos Tickets – PKINIT/certificate-based authentication was used after AD CS abuse to obtain privileged authentication (‘DA certificate’).
• [T1557.001 ] Adversary-in-the-Middle – NTLM relay was performed using coercion primitives such as PetitPotam and PrinterBug (‘PetitPotam / PrinterBug / DFSCoerce → relay’).
• [T1210 ] Exploitation of Remote Services – EternalBlue/MS17-010 was used for direct compromise on a legacy SMB target (‘Remote code execution’).
• [T1003.001 ] LSASS Memory – LSA dumps were collected from compromised systems (‘LSA dumps’).
• [T1003.002 ] Security Account Manager – SAM dumps were collected from compromised systems (‘SAM and LSA dumps’).
• [T1560.001 ] Archive Collected Data – PowerShell was used to create 7-Zip archives before exfiltration (‘PowerShell-driven 7-Zip archiving in 50GB chunks’).
• [T1041 ] Exfiltration Over C2 Channel – Staged archives were pulled out after being prepared for transfer (‘staged and pulled’).
• [T1486 ] Data Encrypted for Impact – The Aurora encryptor was deployed to encrypt files on Windows, Linux, and ESXi systems (‘encryptor itself’).
• [T1489 ] Service Stop – The ESXi variant force-killed running virtual machines before encryption (‘force kills each one individually’).
• [T1490 ] Inhibit System Recovery – The Windows variant deleted shadow copies and disabled System Restore (‘delete every volume shadow copy’).
• [T1059.001 ] PowerShell – PowerShell was used for archiving and staging data (‘PowerShell-driven 7-Zip archiving’).
• [T1027 ] Obfuscated Files or Information – The encryptor and tooling were staged in ways meant to reduce easy analysis, including unusual Zig static builds (‘Zig is a different choice’).