INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Aurora Publishes New Victim Ernesto Malvestiti S.p.A
|
2026-10-26 08:34
CRITICAL
LOW
RANSOMWARE & EXTORTION
Executive Summary
AI-generated
On October 26, 2026, Italian manufacturer Ernesto Malvestiti S.p.A., which supplies automotive OEMs including BMW, Valeo, BorgWarner, and Fiat, was targeted in a ransomware attack. The attackers published the company's sensitive data on the dark web, exposing payroll database information for over 1,000 employees, as well as medical fitness records, union membership lists, and financial data. The attackers also stole plaintext OEM portal credentials for at least 50 companies, including BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40 more. The attack appears to be an exfiltration tactic, with the attackers publishing the stolen data on a dark web platform without demanding ransom payments.
Technical Mitigations AI-generated
• Patch SQL Server to prevent exploitation of the PAGHENET payroll database backup (SQL injection vulnerability)
• Use a secure password manager to rotate and store ADP payroll SFTP credentials in WinSCP.ini
• Implement access controls for plaintext OEM portal credentials stored in accesso <a href="/auth/login?next=/detail/u2Tsd6EBo0ihlvYpAs5x" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN • LOGIN REQUIRED]</span></a>, such as encryption or tokenization
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected
Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.
files 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
IT
manufacturingmanufacturing
automotiveautomotive
financefinance
Incident Timeline
2024-2025
Threat actors used a data breach to target Ernesto Malvestiti S.p.A., exfiltrating 614 MB of sensitive financial and controlling data.
Click on any entity below to view its context and source!
organisation
P&L
614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
data_breach
614 MB
614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
2026/10/26
Aurora has published a new victim, Ernesto Malvestiti S.p.A., after exposing sensitive data including payroll database server credentials and OEM portal access information.
Click on any entity below to view its context and source!
organisation
BMW B2B
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
organisation
BorgWarner SAP
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
organisation
Fiat
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
organisation
Peugeot
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
data_breach
50 portal credentials
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
organisation
Ernesto Malvestiti S.p.
🏴☠️ Aurora has just published a new victim : Ernesto Malvestiti S.p.A..
Description:
organisation
Ernesto Malvestiti S.p.A.
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
BMW
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
Valeo
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
BorgWarner
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
Schneider Electric
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
Fiat/Stellantis
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
OEM
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
organisation
IBAN bank
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings.
infrastructure
1.1 GB Server backup ×7 copies
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings.
organisation
INAZMST
Plus the INAZMST employee master database (181 MB ×5).
data_breach
181 MB ×5
Plus the INAZMST employee master database (181 MB ×5).
organisation
IP
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
organisation
PLC
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
organisation
FANUC
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
data_breach
1.5 GB
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
data_breach
483 MB
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
Tactical Metrics
Metrics
data_breach
50
Portal Credentials
Click for context!
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
Metrics
infrastructure
1
Gb Server Backup ×7 Copies
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings.
Metrics
data_breach
181
Mb ×5
Plus the INAZMST employee master database (181 MB ×5).
Metrics
data_breach
614
Mb
614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
Metrics
data_breach
2
Gb
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
Metrics
data_breach
483
Mb
1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
Intelligence Sources
Ransomware Live
2026-10-26
Unpublish from Social Media?
Are you sure you want to delete this podcast video from all synchronized social networks (YouTube, Facebook, Threads)?
Important:
Due to Meta API restrictions, Instagram Reels cannot be deleted automatically via API by third-party apps.
View Profile to Delete Manually
View Profile to Delete Manually
Tactical Intelligence
Report Intelligence Issue
Podcast Options
Generate
Incident Version History
CURRENT VERSION
Last Updated: 2026-10-26T11:49
Comprehensive Tactical Telemetry
Highly Correlated Entities
18x
organisation
Identified Entity
BMW B2B
entity
3x
industry
Targeted Sector
Manufacturing
sector
2x
tactic
Cyber Operation Type
Exfiltration
tactic
2x
timeline
Temporal Reference
2024-2025
date
2x
data breach
Mb
614
mb
Contextual Telemetry
Context Block
11 METRICS
data breach
Portal Credentials
50
portal credentials
malware
Malware Payload
Hydraq
tool
target region
Target Country
Italy
country
general metric
Automotive Oem
150
automotive oem
tactic
MITRE ATT&CK Technique
T1584.004 - Server
technique
infrastructure
Gb Server Backup ×7 Copies
1
gb server backup ×7 copies
data breach
Mb ×5
181
mb ×5
data breach
Gb
2
gb
general metric
Blanking
300
blanking
general metric
Gdpr Article
9
gdpr article
general metric
Job Candidate
560
job candidate
Click on any entity below to view its context in the main text!
Selective Unpublish
Select the networks you want to remove this post from. The system will try to delete the real post through the API and clean the database so you can publish it again.
By navigating this website, you accept the use of strictly necessary technical cookies for session security and basic platform functionality. We do not use tracking or advertising cookies. Read our Privacy Policy.