# Aurora ransomware claims Adams Warehouse breach

Published: 2026-10-16 · Severity: high · Sectors: transportation, healthcare
Canonical: https://vorant.io/reports/a0f77068-a705-528a-8ee0-6e287173fde5/aurora-ransomware-claims-adams-warehouse-breach

> Aurora ransomware group claims theft of Adams Warehouse & Delivery's full server backups, including SSNs, credentials, and accounting data.

A ransomware.live listing attributes a data leak claim to the Aurora ransomware group against Adams Warehouse & Delivery, Inc., a Houston-area family-owned freight and logistics company operating 11 facilities since 1976. The claimed dataset reportedly includes complete server backup mirrors spanning multiple drives, Sage/Peachtree accounting records for 8 entities covering FY2007–FY2025+, and personal data for 52–72 individuals including Social Security numbers, health insurance IDs, and emergency contacts across four entities.

Of particular concern to defenders is the reported presence of domain administrator passwords stored in plaintext within RDP files, along with plaintext VPN credentials, WiFi passwords, and 18 database connections configured with blank passwords — indicative of poor credential hygiene that could have facilitated initial access or lateral movement. The leak also allegedly includes proprietary source code for the company's custom warehouse distribution management system (VB6/.NET), 20+ years of customer data for 100+ clients (including named large enterprises), third-party medical clinic bookkeeping data with a physician's SSN, and 11 Outlook PST archives.

No technical details on the initial intrusion vector, malware used, or exploited vulnerabilities are provided in this listing. This is a victim-disclosure/leak-site entry rather than technical threat research; defenders at logistics and SMB organizations should treat this as a reminder to audit for plaintext credential storage (RDP files, saved VPN/WiFi passwords, blank-password database connections) and to review backup security, as these were apparently key factors in the scope of this breach.

## Mentioned in this report

- Threat actors: aurora
- Malware: Aurora

## Detection guidance (public sample)

### Recursive Findstr Search for Passwords in Files

ATT&CK: T1552.001

findstr.exe run recursively with 'password' as a search term, a common way to hunt for plaintext credentials in config, script and RDP files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Recursive Findstr Search for Passwords in Files
id: 573fc96b-2417-54b0-88fd-1c8dbb2617ee
status: experimental
description: Detects findstr.exe run recursively (/s) with a password search term,
  a common way to hunt for plaintext credentials in files such as .rdp, .config, .ini
  and .txt. Generalises on the tool and arguments, not on any specific path.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \findstr.exe
  - OriginalFileName: FINDSTR.EXE
  selection_term:
    CommandLine|contains: password
  selection_recurse:
    CommandLine|contains|windash: ' /s'
  condition: selection_img and selection_term and selection_recurse
falsepositives:
- Administrators or developers auditing configuration files for hard-coded passwords
- Security audit tooling that scans for plaintext secrets
level: medium
author: Vorant
references:
- https://www.ransomware.live/id/QWRhbXMgV2FyZWhvdXNlICYgRGVsaXZlcnksIEluYy5AYXVyb3Jh
```

### Search for RDP Files Across the File System

ATT&CK: T1552.001

Recursive enumeration of *.rdp files via cmd, PowerShell or where.exe, which can expose saved RDP credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Search for RDP Files Across the File System
id: de06c7cc-14fc-5dc8-9fa1-e3670881ea12
status: experimental
description: Detects command lines that recursively enumerate *.rdp files with dir,
  where, Get-ChildItem or findstr. Attackers do this to locate saved RDP connections
  that may hold plaintext or weakly protected credentials.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \where.exe
    - \findstr.exe
  selection_rdp:
    CommandLine|contains: '*.rdp'
  selection_recurse:
    CommandLine|contains:
    - ' /s'
    - ' /r '
    - -Recurse
    - where /r
  condition: selection_img and selection_rdp and selection_recurse
falsepositives:
- Administrators inventorying or migrating saved RDP connection files
- Backup or profile migration scripts that enumerate .rdp files
level: medium
author: Vorant
references:
- https://www.ransomware.live/id/QWRhbXMgV2FyZWhvdXNlICYgRGVsaXZlcnksIEluYy5AYXVyb3Jh
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/QWRhbXMgV2FyZWhvdXNlICYgRGVsaXZlcnksIEluYy5AYXVyb3Jh

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a0f77068-a705-528a-8ee0-6e287173fde5/aurora-ransomware-claims-adams-warehouse-breach.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup