> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Aurora ransomware leaks ITAR data from SpaceX supplier Rapid Manufacturing
- URL: https://f4n6.co.uk/security-feed/aurora-ransomware-leaks-itar-data-from-spacex-supplier-rapid-manufacturing/
- Published: 2026-10-30T20:56:11.000Z
- Updated: 2026-10-30T20:56:11.000Z
- Author: Jeff Davies
- Tags: #security-feed, aurora

## 1\. Executive summary

The aurora ransomware group listed Rapid Manufacturing, a 50-year-old electronics contract manufacturer in Anaheim, California with operations in Ensenada, Mexico, on its leak site on 2026-10-30\. Rapid Manufacturing is a Tier-1 supplier to SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX) and Millennium Space (Boeing), and the material the group claims to hold includes ITAR-controlled engineering drawings for Falcon 9/Heavy, Starship and Draco propulsion systems, 26 ITAR customer quoting accounts, and 600 to 1,200 employee records with US SSNs, bank accounts and I-9/immigration data and Mexican RFC, CURP, IMSS and payroll data. No CVE, CVSS score or CISA KEV entry is associated with this item, and aurora has no MITRE ATT&CK profile, so the attribution is unconfirmed. For EMEA financial services the direct exposure is limited, but any client with a defence, space or advanced-manufacturing lending, insurance, trade-finance or supplier relationship touching this supply chain should treat the leaked quoting accounts and engineering data as a counterparty and sanctions-screening problem, not only a cyber one.

## 2\. Regulatory framing

| Article            | Trigger (the fact in this item)                                                                                                                                                                                   | Practical impact                                                                                                                                                                                                                                                               |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| DORA Art. 28       | The victim is a Tier-1 supplier inside the SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace and Millennium Space supply chain, and the leak includes 26 ITAR customer quoting accounts. | A client that relies on Rapid Manufacturing, or on a prime that relies on it, must establish whether that dependency is an ICT third-party relationship in scope and whether the leaked quoting accounts expose commercial or credential material held on the client's behalf. |
| NIS2 Art. 21(2)(d) | The leaked material is the supplier's customer and quoting architecture across multiple defence primes, which is supply chain information rather than the client's own data.                                      | In-scope entities must assess supply chain security measures for this supplier and its primes, including whether the leaked account data gives an attacker a route into the client's own procurement or supplier portals.                                                      |

No other article in the reference is engaged by the facts here. The item is a leak-site listing with no technical detail on intrusion, so DORA Art. 17, 18, 19 and 24 and NIS2 Art. 23 are not triggered by anything in the source.

## 3\. Technical analysis & attack chain

The source is a leak-site listing. It states that aurora named Rapid Manufacturing as a victim and describes the categories of material the group claims to hold. It gives no initial access vector, no exploited component or CVE, no malware capability, no persistence mechanism, no command-and-control detail and no exfiltration method. No attack chain can be reconstructed from it, and none is presented here.

What the listing does describe is the claimed contents of the leak:

1. ITAR-controlled engineering drawings and manufacturing processes for Falcon 9/Heavy, Starship and Draco propulsion systems, including RTD soldering acceptance criteria, visual inspection standards, cable thermocouple assemblies and production master plans.
2. 26 ITAR customer quoting accounts covering SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace and Millennium Space.
3. Employee records for 600 to 1,200 people across the US and Mexico, with US data including SSN, bank accounts, payroll and I-9/immigration records and Mexican data including RFC, CURP, IMSS, bank accounts and nóminas, dated from 2019 through August 2026.
4. Attorney-client privileged material including settlement agreements, severance terms, internal investigation files and a recorded termination meeting (audio).

The listing also contains redacted sections that are not visible in the source, so the full scope of the claimed leak is unknown.

Every claim above is single-sourced to the aurora leak-site listing as indexed by ransomware.live. The group's assertion that it holds this material is not corroborated by Rapid Manufacturing, by any of the named primes, or by a second independent source in the material provided. The volume figures (600 to 1,200 records) are the group's own and should be treated as unverified. The attribution to aurora is unconfirmed: the group has no MITRE ATT&CK profile, and nothing in the source establishes its identity, sponsorship or prior targeting pattern.

## 4\. Mitigation & containment

The source gives no vendor fix, no patch and no technical indicator, so containment here is about third-party and data exposure rather than host remediation.

### P1 (within 24h)

- Identify every client relationship, credit exposure, insurance policy or trade-finance facility that depends on Rapid Manufacturing or on a prime named in the listing (SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, Millennium Space). Record the dependency and the contract owner.
- If the client holds a quoting, procurement or supplier-portal account with Rapid Manufacturing, suspend or rotate credentials for that account and review its access logs for use from unexpected locations. The listing claims 26 ITAR quoting accounts are exposed.
- Ask any prime in the chain whether it has been notified and whether it has paused data exchange with Rapid Manufacturing.

### P2 (within 72h)

- Screen the leaked employee-record categories against the client's own KYC and payroll data only where the client is a counterparty to Rapid Manufacturing; do not ingest the leaked data itself. The US records include SSN, bank account, payroll and I-9/immigration data and the Mexican records include RFC, CURP, IMSS and bank account data, all of which are identity-fraud primitives.
- Review whether any client staff appear in the leaked privileged material (settlement agreements, severance terms, internal investigation files, recorded termination meeting) and prepare a legal-privilege and employment-law response if so.
- Confirm with the client's trade-compliance function whether any ITAR-controlled technical data held by the client or its primes could have passed through Rapid Manufacturing, and whether a voluntary disclosure assessment is needed.

### P3 (within 7 days)

- Add Rapid Manufacturing to the supplier-risk register with the leak as the trigger event, and set a review date tied to the supplier's public statement.
- Where the client is itself an in-scope NIS2 entity, document the supply chain security assessment for this supplier under the process the client already runs for Art. 21(2)(d).

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The listing gives no hashes, domains, IP addresses, file paths, registry keys or command lines. The only atomic identifiers are the victim name and the leak-site listing URL, which are not threat indicators and are not reproduced as such.

## 6\. Detection

Insufficient indicators to author detection rules.

## 7\. Sources

- ransomware.live, "Victim: Rapid Manufacturing – aurora", https://www.ransomware.live/id/UmFwaWQgTWFudWZhY3R1cmluZ0BhdXJvcmE=, published 2026-10-30T15:03:11Z. Single source for all victim, data-category and volume claims in this advisory.

## 8\. Adverse Trace position

Adverse Trace assesses this as a third-party and data-exposure event with no technical exploitation detail available, and we are not assigning it a CVSS severity because no CVE is associated and the source does not support one. The attribution to aurora is unconfirmed: the group has no MITRE ATT&CK profile and the only claim of its involvement is its own leak-site listing, which is single-sourced. For EMEA financial services clients the direct cyber impact is low unless the client has a live supplier, credit, insurance or trade-finance relationship with Rapid Manufacturing or with a prime named in the listing, in which case the leaked quoting accounts and ITAR technical data are the material concern. We will monitor for a public statement from Rapid Manufacturing or any of the named primes, for a second independent source corroborating the leak contents, and for any technical detail on the intrusion, and we will reissue this advisory if that changes the assessment. Clients who confirm an exposure should contact their Adverse Trace handler to scope the supplier and trade-compliance review.

---

[Read the original source →](https://www.ransomware.live/id/UmFwaWQgTWFudWZhY3R1cmluZ0BhdXJvcmE=?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*