OTX Threat: Caught in 4K: The Aurora Files

An exposed directory revealed extensive Aurora ransomware operations by a Russian-speaking affiliate active against over twenty organisations between April and July 2026. The misconfigured server exposed the operator's complete toolkit, shell history, AI-assisted attack planning via Cursor, and the Aurora encryptor written in Zig. CloudSEK recovered keys enabling visibility into ransom negotiation Sectors: Manufacturing, Agriculture, Finance