Aurora ransomware leaks Evosys Laser data

30 July 2026 high threat manufacturing

Ransomware group Aurora claims a breach of German laser-welding manufacturer Evosys Laser, leaking HR, financial, and industrial control data.

Ransomware.live has indexed a listing attributed to a group tracked as Aurora claiming compromise of Evosys Laser GmbH, an Erlangen-based manufacturer of industrial laser welding systems with roughly 130 employees and subsidiaries in the US and China. The claimed dataset represents the company's full corporate repository: complete HR files for all employees (contracts, salaries, IBANs, tax and social insurance IDs, pension and medical records, including health data for two minors), a full internal infrastructure map derived from mRemoteNG configuration exports (seven named servers, domain admin credentials, internal IP ranges), and a Citrix administrator account reportedly secured with the password "Password1".

Beyond IT infrastructure exposure, the leak allegedly includes 326 GB of customer project data covering laser welding process parameters, CAD files, robot control software, and proprietary AQW process know-how — intellectual property of clear interest to Tier 1 automotive supply chain competitors. Financial statements spanning 2015–2028, executive compensation, attorney-client privileged communications, and whistleblower reports filed under Germany's HinSchG are also claimed, alongside industrial control assets: robot SRS source code, PLC programs, and nginx private keys for laser system web interfaces plus VPN configurations enabling remote access into customer sites.

This is a single-victim data-extortion posting rather than evidence of an active, ongoing intrusion or exploited vulnerability; no technical indicators, malware samples, or CVEs were disclosed in the source material. The exposure of hardcoded weak credentials, domain admin secrets, and VPN configurations tied to third-party customer environments creates meaningful downstream risk for Evosys's automotive OEM customers if the data is authentic and released.

Mentioned in this report

Threat actors aurora

Malware Aurora

Detection guidance

Non-mRemoteNG Process Accessing mRemoteNG Credential Store

ATT&CK T1552.001

Detects a process other than mRemoteNG.exe itself opening/reading the confCons.xml connection file, which stores encrypted host credentials and is a common target for credential harvesting after host compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Non-mRemoteNG Process Accessing mRemoteNG Credential Store
description: Detects processes other than mRemoteNG.exe reading or copying the mRemoteNG
  confCons.xml configuration file, which stores encrypted connection credentials (hostnames,
  domain accounts). Attackers commonly exfiltrate or parse this file to recover internal
  infrastructure maps and privileged credentials, as seen in the Aurora/Evosys leak.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \mRemoteNG\confCons.xml
  filter_legit_app:
    Image|endswith: \mRemoteNG.exe
  condition: selection and not filter_legit_app
falsepositives:
- Backup or file sync agents (OneDrive, robocopy scheduled backups) reading the user
  profile folder
- IT asset migration scripts copying mRemoteNG profiles between machines
level: high
id: 32f9c24b-851e-5c4b-9377-143536df7a84
status: experimental
author: Vorant

Command Line Referencing mRemoteNG Configuration for Password Extraction

ATT&CK T1552.001

Detects command-line or script activity that references the mRemoteNG config file together with decryption/parsing keywords, indicative of tools (e.g. mRemoteNG password decryptors) used to recover stored host credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Command Line Referencing mRemoteNG Configuration for Password Extraction
description: Detects PowerShell, cmd, or scripting engines invoked with command lines
  that reference mRemoteNG's confCons.xml alongside decrypt/password-related keywords,
  consistent with publicly available mRemoteNG credential decryption utilities used
  to harvest domain admin and infrastructure credentials post-compromise.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: confCons.xml
  keywords:
    CommandLine|contains:
    - decrypt
    - Decrypt
    - password
    - Password
    - AES
  condition: selection and keywords
falsepositives:
- Legitimate mRemoteNG migration or backup scripts written by administrators that
  reference the config path
- Security audits intentionally reviewing stored connection credentials with authorization
level: high
id: a30c1b62-d10d-55a5-80a2-5916b86a26fc
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/RXZvc3lzIExhc2VyIEdtYkhAYXVyb3Jh

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free