VORANT. Threat Intelligence Sign in Get the full feed

Jinny Beauty Supply data leaked by Aurora group

elevated threat retail

Ransomware/extortion group Aurora has listed Korean-American wholesale distributor Jinny Beauty Supply, exposing credentials, VMware root access, card data and employee PII.

Ransomware.live has indexed a victim listing for Jinny Beauty Supply, one of the largest Korean-American wholesale beauty distributors in the US, operating nine distribution centers and serving over 7,400 beauty supply stores. The listing, attributed to a group identified in the source URL as 'aurora', claims exposure of an extensive set of sensitive material including a password vault with 50+ plaintext credentials for financial platforms (PayPal, Braintree), e-commerce and logistics services (Amazon Seller Central, eBay, FedEx, UPS, ShipStation), ERP systems (Acumatica), and cloud/productivity services (Microsoft 365, Google Analytics).

Most concerning for defenders is the reported exposure of VMware vCenter and ESXi root credentials, which would grant complete control over the victim's virtualization infrastructure, alongside Active Directory enumeration data covering 239+ user accounts (17 with admin rights), server topology across seven sites, and DPAPI-encrypted RDP passwords — all of which could enable further lateral movement or a follow-on intrusion if the environment has not been fully remediated. Additional exposed data includes scanned credit card authorization forms with full PANs and CVVs, employee tax documents (W-4/I-9 forms with SSNs), direct deposit banking details, a Shopify customer database, and SQL Server e-commerce backups.

No technical indicators (malware samples, C2 infrastructure, exploited CVEs) are included in this listing; it functions as a data-leak/extortion notice rather than a technical intrusion report. Organizations in retail and distribution sectors, particularly those relying on similar ERP/e-commerce stacks and third-party payment integrations, should treat this as a reminder to rotate any credentials found in password vaults, audit VMware and AD privileged account hygiene, and review data handling practices for cardholder and employee PII.

Mentioned in this report

Threat actors aurora

Related reporting

Detection guidance

Credentials Harvested from Password Vault Files

ATT&CK T1552.001

Detection of file access patterns consistent with bulk credential extraction from password managers or vault files containing plaintext credentials for financial/cloud services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credentials Harvested from Password Vault Files
description: Detects processes reading or copying files with naming patterns typical
  of password vaults, credential stores, or export archives that commonly contain
  plaintext credentials for financial platforms, e-commerce, cloud services, and infrastructure
  systems. This behavioural pattern reflects bulk credential exfiltration via file
  system access rather than credential API calls.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_vault_patterns:
    TargetFilename|contains:
    - password
    - credential
    - vault
    - export
    - backup
    TargetFilename|endswith:
    - .csv
    - .xlsx
    - .xls
    - .txt
    - .json
  selection_access:
    EventType:
    - CreateKey
    - WriteFile
    - ReadFile
  filter_system_processes:
    Image|endswith:
    - \System32\svchost.exe
    - \System32\lsass.exe
    - \System32\winlogon.exe
  filter_legitimate_tools:
    Image|endswith:
    - \Microsoft Office\root\Office16\EXCEL.EXE
    - \Microsoft Office\root\Office16\WINWORD.EXE
  condition: (selection_vault_patterns and selection_access) and not (filter_system_processes
    or filter_legitimate_tools)
falsepositives:
- Legitimate password manager exports during scheduled backups
- IT administrators accessing credential stores for authorized rotation
- Enterprise backup software scanning password vault locations
level: high
id: c43e6427-0d68-50de-959c-f4a2a95304e8
status: experimental
author: Vorant

VMware vCenter Credential Access and Enumeration

ATT&CK T1078

Detection of process activity accessing VMware vCenter configuration files, credential stores, or performing infrastructure enumeration consistent with privileged account compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VMware vCenter Credential Access and Enumeration
description: Detects processes accessing VMware vCenter configuration, credential,
  or inventory files that would indicate harvesting of root credentials or infrastructure
  topology data. Includes file access to vpxd configuration, inventory databases,
  and credential stores typical of vCenter administrative access.
tags:
- attack.discovery
- attack.t1087
- attack.t1078
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - vpxd
    - vpxa
    - inventory
    - cis
    - platform-services
    TargetFilename|endswith:
    - .conf
    - .cfg
    - .xml
    - .properties
    - .db
  filter_vmware_services:
    Image|contains: VMware
  condition: selection and not filter_vmware_services
falsepositives:
- VMware Update Manager or vCenter patch deployment accessing configuration files
- Backup software enumerating vCenter configuration for disaster recovery
level: high
id: bafdeefe-a391-5e16-ad5e-3a255b234377
status: experimental
author: Vorant

Active Directory Enumeration and Credential Extraction

ATT&CK T1005

Detection of tools or processes performing bulk enumeration of Active Directory objects, user accounts with privileged roles, and extraction of password hashes or DPAPI-encrypted credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Active Directory Enumeration and Credential Extraction
description: Detects process execution patterns consistent with bulk AD enumeration
  targeting user accounts and privileged group membership, or file system access to
  NTDS.dit, registry hives, or DPAPI-encrypted credential stores. Behavioural pattern
  reflects discovery of 200+ user accounts and admin privilege mapping.
tags:
- attack.discovery
- attack.t1087
- attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_ldap_enum:
    CommandLine|contains:
    - dsquery
    - ldapsearch
    - Get-ADUser
    - Get-ADGroup
    - Get-ADGroupMember
  selection_cred_dump:
    CommandLine|contains:
    - ntds.dit
    - HKLM\\SAM
    - HKLM\\SECURITY
    - lsass
    - sekurlsa
  selection_mimikatz:
    Image|contains:
    - mimikatz
    - Mimikatz
  filter_legitimate_admin:
    Image|endswith:
    - \System32\dsquery.exe
  filter_group_policy:
    ParentImage|contains: gpupdate
  condition: (selection_ldap_enum or selection_cred_dump or selection_mimikatz) and
    not (filter_legitimate_admin or filter_group_policy)
falsepositives:
- Legitimate AD auditing scripts executed by IT security teams
- Third-party identity governance tools performing scheduled user provisioning scans
- Security scanning tools conducting authorized privilege audits
level: high
id: e622692b-2bfb-506b-88f3-d530324b3bd4
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/SmlubnkgQmVhdXR5IFN1cHBseUBhdXJvcmE=

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free