Orion
| Active | RaaS
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Victims
14
First Discovered
2026-08-05
victim
Last Discovered
2026-08-05
victim
Inactive Since
0
days
Avg Delay
261.6
days
Infostealer
78.6%
victims with domain
Countries
4
hit
Attack Velocity — Last 12 months
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Blog - Orion | Yes | 2026-08-05T23:38:39 | Apache 2.4.58 |
cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 3
- Professional Services 2
- Transportation 2
- Retail & E-Commerce 2
- Other 1
Top 5 Countries
-
United States
5
-
United Kingdom
2
-
Germany
2
-
India
2
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
tox
1
| Type | IOC |
|---|---|
tox
|
32C12B278912E26E5EAC57AEBB3F4FF16F0E31603C7B9D46AC02E9D993EE14351CEC3AB5945C
|
Victims (14)
We only seek money. No morals, no political stance Your data is only secure IF you pay us…