Aurora ransomware leaks Buckner Company data
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware group Aurora claims breach of insurance broker Buckner, leaking credentials, SSNs, payroll and M&A documents.
The Aurora ransomware group has listed The Buckner Company, Inc., a Salt Lake City-based commercial property & casualty insurance brokerage, as a victim on its leak site. The claimed exfiltrated dataset is extensive and highly sensitive: over 1,500 plaintext credentials pulled from browser password exports (Chrome, Edge, Google) belonging to at least eight employees, plus 20+ password spreadsheets covering insurance carrier portals (Hartford, Travelers, Chubb, Progressive, Sedgwick), banking and personal accounts.
Beyond credentials, the leak reportedly includes employee SSNs for 150-250 individuals via W-2 and 1099-NEC filings across multiple related entities (2019-2023), payroll and compensation data from Paycom spanning three years, 316 individual compensation PDFs, driver's license scans for seven named individuals, and the Applied Epic insurance management database file (Epic.mdf). Also claimed are 128 Outlook PST archives of business correspondence, corporate tax returns dating back to 2004, and a full M&A due-diligence pipeline including the BroadStreet Partners acquisition closing package with disclosure schedules and corporate structure documents.
No technical details of the intrusion vector, malware used, or exploited vulnerability are provided in this listing. Defenders at insurance brokerages and similarly structured organizations should treat this as a reminder to audit browser-stored credential practices, restrict plaintext password spreadsheets, and review access controls around HR/payroll systems (Paycom), M&A due-diligence repositories, and insurance management databases such as Applied Epic. Affected individuals should be monitored for identity theft and credential-stuffing risk given the scale of exposed personal and financial data.
Mentioned in this report
Detection guidance
Browser Credential Store Accessed via Command Line by Non-Browser Process
Detects command lines that reference Chrome or Edge 'Login Data' or 'Local State' files, as used to copy or read browser-saved passwords for theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Credential Store Accessed via Command Line by Non-Browser Process
description: Detects process command lines referencing the Chrome or Edge profile
Login Data or Local State files, which hold saved credentials and the key that decrypts
them. Such access from a non-browser process is typical of credential harvesting
ahead of exfiltration.
tags:
- attack.credential-access
- attack.t1555.003
logsource:
category: process_creation
product: windows
detection:
selection_browser:
CommandLine|contains:
- \Chrome\User Data
- \Edge\User Data
selection_file:
CommandLine|contains:
- \Login Data
- \Local State
filter_browser:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \GoogleUpdate.exe
condition: selection_browser and selection_file and not filter_browser
falsepositives:
- Backup or profile migration scripts copying browser profile data
- Forensic or EDR tooling that inspects browser profiles
level: medium
id: 12c31af2-5c4c-5b12-a3dd-5e4a3df29b8d
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VGhlIEJ1Y2tuZXIgQ29tcGFueSwgSW5jLkBhdXJvcmE=
Rclone Style Bulk Data Transfer to Remote Cloud Storage
Detects rclone executed with copy, sync or move verbs, commonly used to bulk-exfiltrate stolen files to cloud storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Style Bulk Data Transfer to Remote Cloud Storage
description: Detects rclone.exe (by image name or original file name) run with copy,
sync or move verbs, a common way to exfiltrate large volumes of documents, databases
and mail archives to web or cloud storage before extortion.
tags:
- attack.exfiltration
- attack.t1567
logsource:
category: process_creation
product: windows
detection:
selection_tool:
- Image|endswith: \rclone.exe
- OriginalFileName: rclone.exe
selection_verb:
CommandLine|contains:
- ' copy '
- ' sync '
- ' move '
- ' copyto '
condition: selection_tool and selection_verb
falsepositives:
- Administrators using rclone for sanctioned backups to cloud storage
- Developer workstations syncing build artifacts
level: high
id: 4f8c31d7-12b7-5f9b-bf42-f76f0fc38106
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VGhlIEJ1Y2tuZXIgQ29tcGFueSwgSW5jLkBhdXJvcmE=
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/VGhlIEJ1Y2tuZXIgQ29tcGFueSwgSW5jLkBhdXJvcmE=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs