> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Aurora ransomware group leaks NatWest banking data and payroll records from UK manufacturer…
- URL: https://f4n6.co.uk/security-feed/aurora-ransomware-group-leaks-natwest-banking-data-and-payroll-records-from-uk-manufacturer/
- Published: 2026-10-22T13:46:12.000Z
- Updated: 2026-10-22T13:46:12.000Z
- Author: Jeff Davies
- Tags: #security-feed, aurora

## 1\. Executive summary

The aurora ransomware group listed Allmand-Smith Limited (trading as Stormguard), a UK building-products manufacturer in Stoke-on-Trent, on its leak site on 2026-10-21\. The posted material includes what the group describes as a live NatWest Bankline database (blfw.db, 21.3 MB), WorldPay payment gateway credentials, Sage 200 accounts-receivable and accounts-payable records with customer and supplier bank details across 15 entities, and a 6.1 GB Sage Payroll archive covering current and former staff. The direct exposure to EMEA financial services is the banking and payment data: account numbers, sort codes, payee details, transaction logs and BACS salary account details for a UK corporate customer. No CVE is associated with this item and there is no CISA KEV entry; the risk is fraud and account takeover against the named bank and payment relationships, not a software vulnerability. Attribution to "aurora" rests on the group's own leak-site claim and is unconfirmed: no MITRE ATT&CK profile exists for this actor.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

The only public account of this intrusion is the aurora leak-site post, indexed by ransomware.live. It is a claim by the operator, not an incident report, and no victim statement, law-enforcement notice or independent forensic account was available at the time of writing. The steps below are what the post asserts; treat each as single-sourced and unverified until the victim or its bank confirms.

1. The group obtained domain administrator credentials, which it published in plaintext as STORMGUARD\\MichaelAdmin with the password 5t0rmGuard. It states it also took a full domain controller dump.
2. It exfiltrated the NatWest Bankline database blfw.db (21.3 MB), described as live and containing account numbers, sort codes, payee details and transaction logs.
3. It took WorldPay payment gateway credentials, held in a file named WorldPay Account Details.xlsx.
4. It took Sage 200 accounts-receivable and accounts-payable data containing bank details for every customer and supplier across 15 entities, plus a consolidated backup age200\_AllmandSmithLtd.bak (2.1 GB).
5. It took Sage Payroll data as Payroll.zip (6.1 GB, 1,185 files): National Insurance numbers, tax codes, PAYE history, gross and net pay per period, BACS salary bank account details, pension contributions and P45/P60 records.
6. It took management accounts for January to July 2024, nominal trial balances and bank reconciliations.

The technical detail that matters to a financial-services reader is the credential and data shape, not a malware chain. A plaintext domain administrator password for a named account is a reusable secret: if it is still valid anywhere the victim's estate federates or shares, it is an immediate lateral-movement path. The Bankline database and the WorldPay credential file are the two items that convert a data breach into payment fraud risk. Bankline is NatWest's corporate online banking channel; a live database with payee details and transaction logs, combined with the Sage 200 supplier bank details, gives an actor the account numbers, sort codes and payee records needed to attempt payment-diversion or mandate fraud against the victim and its counterparties. The payroll archive carries lifetime identifiers (NI numbers) and BACS salary account details for 1,185 files' worth of current and former staff.

The post also states the victim's financial position: revenue £17.66M, profit £1.01M, a "financial health" score of 12/100 described as distressed, and three outstanding NatWest registered charges as of June 2026\. These are the group's characterisation and are not corroborated.

What the post does not give: the initial access vector, the malware or tooling used, dwell time, or any file hash, IP address or domain. No CVE is associated with this item. The claim that the Bankline database is "live" is the operator's assertion and is unverified; whether the data was current at exfiltration is unknown.

## 4\. Mitigation & containment

For EMEA financial-services clients, the exposure is as a counterparty, payer or payee to the victim, not as the breached party. Actions are framed accordingly.

P1 within 24h

- If your institution holds a payment relationship with Allmand-Smith Limited or any of its 15 trading entities, treat inbound payment-detail change requests as high-risk until the victim confirms. Verify any change of bank details by callback to a known number, not a number supplied in the request.
- Screen for the published credential STORMGUARD\\MichaelAdmin / 5t0rmGuard in authentication logs and in any credential-stuffing or password-spray telemetry against your own estate; if the victim shares identity infrastructure with you, force a reset of that account and any account it can reach.
- If you are NatWest or WorldPay, or a downstream processor, treat the Bankline and WorldPay credential exposure as an active fraud vector: review recent payee additions and payment runs on the affected corporate accounts and confirm with the customer out of band.

P2 within 72h

- Add the victim's known bank details (account numbers, sort codes) to fraud-monitoring watchlists so unusual payment activity against them is flagged.
- Where your institution onboards or pays this supplier group, re-verify supplier bank details against records held before the breach date rather than against anything received since.
- Review whether any of your own staff or contractors appear in the leaked payroll set (NI numbers, BACS details) and initiate identity-monitoring or credential-reset steps for them.

P3 within 7 days

- Run a retrospective fraud review of payments to and from the affected entities over the period the leaked transaction logs cover, once the victim or bank can confirm the date range.
- Confirm your third-party risk records reflect the victim's distressed financial position if it is a material supplier or borrower; the group's 12/100 score is unverified but the underlying revenue and charge data should be checked against your own records.

No vendor fix applies: this is a data-exposure and fraud event, not a patchable vulnerability.

## 5\. Indicators of compromise

The source provides no file hashes, network indicators or malware artefacts. The only atomic indicators are the leaked credential and the named data files, which are victim-side artefacts rather than attacker infrastructure.

| type       | value                                 | confidence                      | source          |
| ---------- | ------------------------------------- | ------------------------------- | --------------- |
| credential | STORMGUARD\\MichaelAdmin : 5t0rmGuard | single-sourced (operator claim) | ransomware.live |
| filename   | blfw.db                               | single-sourced                  | ransomware.live |
| filename   | WorldPay Account Details.xlsx         | single-sourced                  | ransomware.live |
| filename   | age200\_AllmandSmithLtd.bak           | single-sourced                  | ransomware.live |
| filename   | Payroll.zip                           | single-sourced                  | ransomware.live |

```iocs
credential  STORMGUARD\MichaelAdmin:5t0rmGuard
filename  blfw.db
filename  WorldPay Account Details.xlsx
filename  age200_AllmandSmithLtd.bak
filename  Payroll.zip

```

These are single-sourced from the operator's leak post; verify before any enforcement action. The filenames are generic and will collide with legitimate files, so use them as context, not as detection signatures.

## 6\. Detection

The source gives no malware strings, command lines, mutexes or network artefacts, so a YARA rule built on threat artefacts is not possible. The only defensible detection is behavioural: authentication using the leaked account name, and payment-fraud patterns against the victim's details. A Sigma rule for the credential use is below; the account name is an exact artefact from the source.

```yaml
title: Authentication attempt using leaked STORMGUARD domain admin account
id: 8f3c2a10-aurora-stormguard-2026
status: experimental
author: Adverse Trace
date: 2026-10-22
reference: https://www.ransomware.live/id/QWxsbWFuZC1TbWl0aCBMaW1pdGVkQGF1cm9yYQ==
description: Detects logon attempts using the domain administrator account name published by the aurora group following the Allmand-Smith Limited leak. Single-sourced; tune to your environment.
logsource:
  product: windows
  service: security
detection:
  selection:
    TargetUserName|endswith: '\MichaelAdmin'
  selection_domain:
    TargetUserName|contains: 'STORMGUARD\'
  condition: selection or selection_domain
falsepositives:

  - Legitimate use of a similarly named account in an unrelated STORMGUARD domain
level: high

```

Behavioural indicators, since no atomic attacker indicators exist:

| behaviour                                                                   | where to observe                            | confidence     |
| --------------------------------------------------------------------------- | ------------------------------------------- | -------------- |
| Logon with STORMGUARD\\MichaelAdmin                                         | Windows Security event 4624/4625, DC logs   | single-sourced |
| Payee additions or payment-detail changes on the victim's Bankline accounts | NatWest Bankline audit trail                | single-sourced |
| Use of WorldPay gateway credentials from new source IPs                     | WorldPay access logs                        | single-sourced |
| Inbound requests to change supplier bank details for the 15 entities        | AP mailbox, supplier master data change log | single-sourced |

## 7\. Sources

- ransomware.live, "Victim: Allmand-Smith Limited – aurora", https://www.ransomware.live/id/QWxsbWFuZC1TbWl0aCBMaW1pdGVkQGF1cm9yYQ==, published 2026-10-21.

## 8\. Adverse Trace position

Adverse Trace assesses this as a data-exposure and payment-fraud risk to financial institutions that bank, pay or are paid by Allmand-Smith Limited and its 15 entities, not as a software vulnerability: no CVE is associated and there is no CISA KEV entry to prioritise. The severity of the underlying claim is high for the victim, but every fact here is single-sourced from the operator's leak post, and attribution to "aurora" is unconfirmed because no MITRE ATT&CK profile exists for the actor. We will monitor for victim or NatWest/WorldPay confirmation, for any appearance of the leaked banking data in fraud attempts against our clients, and for further aurora postings naming financial-sector victims, and we will update this advisory if corroborating detail or atomic indicators emerge. Clients with a direct payment relationship to the affected entities should treat payment-detail changes as suspect until confirmed out of band.

---

[Read the original source →](https://www.ransomware.live/id/QWxsbWFuZC1TbWl0aCBMaW1pdGVkQGF1cm9yYQ==?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*