Aurora infostealer malware increasingly adopted by cybergangs

guest · Nov 22, 2022

By Bill Toulas @billtoulas - November 21, 2022

Cybercriminals are increasingly turning to a new Go-based information stealer named ‘Aurora’ to steal sensitive information from browsers and cryptocurrency apps, exfiltrate data directly from disks, and load additional payloads.

According to cybersecurity firm SEKOIA, at least seven notable cybergangs with significant activity have adopted Aurora exclusively, or along with Redline and Raccoon, two other established information-stealing malware families.
Click to expand...

The reason for this sudden rise in Aurora’s popularity is its low detection rates and general unknown status, making its infections less likely to be detected.

Simultaneously, Aurora offers advanced data-stealing features and presumably infrastructural and functional stability.
Click to expand...

Aurora history
Aurora was first announced in April 2022 on Russian-speaking forums, advertised as a botnet project with state-of-the-art info-stealing and remote access features.
As KELA reported earlier this year, Aurora’s author was looking to form a small team of testers to ensure the final product is good enough.

However, in late August 2022, SEKOIA noticed that Aurora was advertised as a stealer, so the project abandoned its goal of creating a multi-function tool.
Click to expand...

Sekoia: Aurora: a rising stealer flying under the radar

November 21 2022
In July 2022, SEKOIA.IO discovered a new Golang botnet advertised by its alleged developer as Aurora botnet since April 2022. Since we published an analysis of the malware and the profile of the threat actor advertising Aurora on underground forums for our clients, the botnet’s activity slowed down.

Since September 2022, Aurora malware is advertised as an infostealer and several traffers teams announced they added it to their malware toolset. Furthermore, SEKOIA.IO observed an increase in the number of Aurora samples distributed in the wild, as well as C2 servers.
Click to expand...

As the Aurora malware is widespread, not well detected, or publicly documented either, SEKOIA.IO analysed Aurora in depth and share the results of our investigation in this article.
Click to expand...

Log in or Sign up

Aurora infostealer malware increasingly adopted by cybergangs

guest Guest

Log in or Sign up

Aurora infostealer malware increasingly adopted by cybergangs

guest Guest

Useful Searches