orion Ransomware
Tracked since Jan 14, 2026
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live