Aurora leaks payroll and OEM credentials from Italian auto supplier Ernesto Malvestiti

1. Executive summary

The aurora ransomware group listed Ernesto Malvestiti S.p.A., a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, on its leak site on 2026-10-26. The listing claims exfiltration of payroll databases, GDPR Article 9 special-category workforce records, more than 50 plaintext OEM portal credentials, a SQL Server administrator password, ADP payroll SFTP credentials, financial data, engineering IP and 560+ candidate CVs. No CVE is associated with this item, no CISA KEV entry applies, and aurora has no MITRE ATT&CK profile, so the attribution is unconfirmed. The direct risk to EMEA financial services is indirect but concrete: the leaked OEM portal credentials and payroll SFTP credentials touch supplier and payment channels that banks and their corporate clients rely on, and the payroll data includes IBANs and tax identifiers that support invoice and payment-diversion fraud. Adverse Trace assesses this as a data-theft and extortion event, not a confirmed ransomware encryption incident; the source does not state that systems were encrypted.

2. Regulatory framing

No DORA incident-reporting article is engaged on the facts available: the source does not establish that an EMEA financial services client suffered an ICT-related incident, only that a supplier was listed.

3. Technical analysis & attack chain

The source is a leak-site listing. It describes what aurora claims to hold, not how access was obtained. No initial-access vector, exploited component, CVE, malware family, persistence mechanism, command-and-control infrastructure or lateral-movement detail is given. The numbered steps below are the confirmed facts of the disclosure only; the intrusion mechanics are unknown.

1. aurora listed Ernesto Malvestiti S.p.A. (IT) on its leak site on 2026-10-26.
2. The listing claims exfiltration of a PAGHENET payroll SQL Server backup (1.1 GB, seven copies) and an INAZMST employee master database (181 MB, five copies).
3. It claims GDPR Article 9 special-category data: medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases and stress assessments for the workforce.
4. It claims a file named accesso web.txt holding 50+ plaintext OEM portal credentials (BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA and 40+ more).
5. It claims a SQL Server administrator password stored in a plaintext ODBC registry export, and ADP payroll SFTP credentials stored in WinSCP.ini.
6. It claims 614 MB of financial and controlling data (2024-2025 balance sheets, revenue by plant, P&L, transfer pricing, cash flow, competitor analysis, banking relationships), 1.5 GB of engineering IP (300+ die designs, 483 MB of technical drawings, press parameters, PLC programs, FANUC robot code, R&D contracts), 160+ client/supplier contracts and 560+ candidate CVs.

The technical significance for a defender is the credential exposure, not the intrusion. Plaintext storage of OEM portal logins in a single text file, a SQL Server administrator password in an ODBC registry export, and SFTP credentials in WinSCP.ini are the artefacts that turn a supplier breach into downstream account takeover and payment fraud risk. The payroll data carries IBANs, codice fiscale and home addresses, which are the inputs to invoice-redirection and identity fraud against the employees and against anyone paying them.

Confidence caveat: every claim above is single-sourced to the ransomware.live listing and is the actor's own assertion. Adverse Trace has not independently verified that the data exists, that it is complete, or that any of it is genuine. The attribution to aurora rests on the leak-site post alone; aurora has no MITRE ATT&CK profile, so the group's identity, sponsorship and tooling are unconfirmed. Treat the credential and data claims as unverified until the victim or a regulator confirms.

4. Mitigation & containment

P1 within 24h

• If your organisation holds an OEM B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat or Peugeot/PSA portal account that shares credentials or trust with Ernesto Malvestiti, rotate those credentials now and review portal access logs for logins from unexpected source addresses since the listing date.
• Where your treasury or AP function pays or receives from Ernesto Malvestiti, apply out-of-band callback verification to any change of bank details before the next payment run; the leaked payroll IBANs and banking-relationship data raise the invoice-fraud risk.
• Block or monitor access to the leak-site URL and any mirrors at the web proxy; do not retrieve the posted data.

P2 within 72h

• Audit your own supplier and payroll integrations for the same pattern: plaintext credentials in files such as accesso web.txt or WinSCP.ini, and database administrator passwords in ODBC registry exports. Move them to a secrets manager and rotate.
• If you use ADP or a comparable payroll processor over SFTP, confirm the processor has rotated any credential that could have transited the compromised channel and verify the SFTP host key and account scope.

P3 within 7 days

• Add the exposed OEM portal domains to enhanced monitoring for credential-stuffing and impossible-travel alerts.
• Review third-party contracts with suppliers of this profile for breach-notification and credential-handling clauses (DORA Art. 30 key contractual provisions).

No vendor fix or patch applies: this is a data-exposure and extortion event, not a software vulnerability.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file hashes) are present in the source. The listing names file and artefact names but gives no network or host indicators. The items below are behavioural and file-name indicators drawn from the actor's claims; they are single-sourced and unverified.

Behavioural indicators

filename  accesso web.txt
filename  WinSCP.ini

6. Detection

The source gives file names and artefact names but no distinctive strings, command-line flags, mutexes or registry keys belonging to the threat itself. The file names accesso web.txt and WinSCP.ini are generic and would generate false positives if used as YARA strings, and the database names are victim-specific, not threat artefacts. There are no log or behavioural indicators specific enough to build a reliable Sigma rule.

Insufficient indicators to author detection rules.

7. Sources

• ransomware.live, "Victim: Ernesto Malvestiti S.p.A. – aurora", https://www.ransomware.live/id/RXJuZXN0byBNYWx2ZXN0aXRpIFMucC5BLkBhdXJvcmE=, published 2026-10-26.

8. Adverse Trace position

Adverse Trace assesses this as a supplier data-theft and extortion listing with unconfirmed attribution: aurora has no MITRE ATT&CK profile, no CVE or CISA KEV entry applies, and the entire data set is the actor's unverified claim. The client impact for EMEA financial services is second-order, through leaked OEM portal and payroll SFTP credentials and through payroll IBAN and banking data that enable payment-diversion fraud against anyone transacting with the victim. We will monitor for corroboration from the victim, Italian authorities or the exposed OEMs, and we will reissue this advisory if the credential exposure is confirmed or if any of the named OEM portals report account compromise. Clients with supplier or payment relationships to Ernesto Malvestiti should treat the credential and banking data as potentially live until rotation is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.