Aur0ra (also written Aurora) is a 2026 ransomware operation with a Windows encryptor and a Linux build aimed at VMware ESXi hosts. Files keep their original names and gain no new suffix, so the clearest sign is a two-line text file, !!!README!!!DO_NOT_DELETE.txt, placed at drive roots and in each scanned folder. It claims confidential data was taken, states that files are encrypted, and gives a Tor chat address plus a 32-character access key. The Linux build pairs ChaCha20 with RSA-4096 key wrapping. Operators have been seen abusing SQL Server command execution, relay and certificate attacks, and cloud storage for data staging, and a leak blog titled Aur0ra lists victims across more than a dozen countries. It is unrelated to the 2018 family of the same name that appends .aurora and has a free decryptor; that older recovery tool does not apply here.
Ransom note filenames: !!!README!!!DO_NOT_DELETE.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161