GILDE Handwerk Macrander GmbH & Co. KG Data Breach

Aurora ransomware has targeted GILDE Handwerk Macrander GmbH & Co. KG, a German manufacturer specializing in craft and giftware production. The listing on Aurora’s dark web leak portal occurred on August 4, 2026, and was identified by SOCRadar’s Dark Web Monitoring service. The company’s industry, manufacturing, and its location in Germany make it a potential target for ransomware operations, particularly given the group’s recent activity patterns. In the 60 days prior to this listing, Aurora claimed nine other victims, with a notable concentration in the manufacturing sector. Other frequently targeted industries include business services and technology. Geographically, Aurora’s victims have been primarily from Germany and the United States, with a significant number also from the Netherlands, indicating a distinct focus on the DACH region and Benelux countries. Notable previous victims include US Installation Group, Inc., Evosys Laser GmbH, Bretford Manufacturing, and Primed Halberstadt Medizintechnik. The disproportionate targeting of German entities within Aurora’s victimology is a point of concern for CTI teams focused on the DACH region.

SOCRadar’s analysis involved querying stealer-log telemetry for the domain gildehandwerk[.]com. The results of this query returned no records, indicating no direct exposure was found within the specific sample analyzed. This finding is categorized as “no_exposure_in_sample”. However, the absence of evidence in this limited query does not definitively confirm the organization is unaffected by compromise. It is important to note the limitations of this telemetry check. The query covered a paginated, limited sample of a much larger dataset. Potential credential exposure could exist under alternate or legacy corporate domains, through regional subsidiaries, or via personal email aliases used on corporate systems. German companies, particularly those in the Mittelstand sector, often maintain parallel .de and .com domains, and this analysis only covered the .com variant. Therefore, credentials indexed against a local .de domain would fall outside the scope of this lookup. The domain gildehandwerk[.]com has been added to SOCRadar’s watch list for continued monitoring. For ransomware groups like Aurora, credentials harvested by infostealers represent a common pathway for initial access. Threat actors or initial access brokers frequently purchase these credentials from underground marketplaces. They then validate these credentials to gain access to corporate environments, such as Microsoft 365, VPNs, or remote-access portals, before deploying ransomware. As a next step, it is recommended to re-run the correlation against GILDE Handwerk’s .de domain to ensure a comprehensive analysis.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.