INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aurora Publishes Rapid Manufacturing as New Victim

| 2026-10-30 15:03 CRITICAL LOW RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
A 50-year-old electronics contract manufacturer in Anaheim, California with operations in Ensenada, Mexico was targeted by a ransomware attack on October 30, 2026. The attackers accessed sensitive data including employee records spanning US and Mexican government-issued identification documents from 2019 through August 2026, amounting to approximately 600–1,200 records. This breach also exposed ITAR-controlled engineering drawings and manufacturing processes for SpaceX's Falcon 9/Heavy, Starship, and Draco propulsion systems, as well as production master plans for these systems. The attack is classified under both exfiltration and ransomware tactics. Rapid Manufacturing, a critical supplier to major aerospace companies including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Boeing, was affected by the incident.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
NORTH_AMERICA NORTH_AMERICA manufacturingmanufacturing aerospaceaerospace
Incident Timeline
‎August 2026
Threat actors used ransomware to target Rapid Manufacturing, exposing 600–1,200 employee records spanning US and Mexico.
target_region Mexico
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
target_region United States
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
organisation SSN
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
organisation I-9/immigration
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
organisation RFC
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
organisation CURP
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
organisation IMSS
<redacted> <redacted> 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
‎2026/10/30
Threat actors published sensitive ITAR-controlled engineering drawings and manufacturing processes for various aerospace systems, compromising a critical Tier-1 supplier to multiple prominent companies.
organisation Rapid Manufacturing
🏴‍☠️ Aurora has just published a new victim : Rapid Manufacturing.
organisation Falcon & Starship
But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing).
organisation Northrop Grumman
But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing).
organisation Collins Aerospace
But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing).
organisation Boeing
But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing).
organisation Falcon 9/Heavy, Starship
The exposed material includes: <redacted>> ITAR-controlled engineering drawings and manufacturing processes for Falcon 9/Heavy, Starship, and Draco propulsion systems — RTD soldering acceptance criteria, visual inspection standards, cable thermocouple assemblies, and production master plans.
organisation Draco
The exposed material includes: <redacted>> ITAR-controlled engineering drawings and manufacturing processes for Falcon 9/Heavy, Starship, and Draco propulsion systems — RTD soldering acceptance criteria, visual inspection standards, cable thermocouple assemblies, and production master plans.
organisation ITAR
26 ITAR customer quoting accounts including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Millennium Space — the complete defense/space revenue architecture.
victims 26 ITAR customer
26 ITAR customer quoting accounts including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Millennium Space — the complete defense/space revenue architecture.
Tactical Metrics
Metrics
victims
26
Itar Customer
26 ITAR customer quoting accounts including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Millennium Space — the complete defense/space revenue architecture.
Intelligence Sources
Ransomware Live 2026-10-30