Loading threat actor…
Orova is a financially motivated ransomware and data-extortion group active since mid-2026. It targets corporate networks and uses double extortion, combining data exfiltration with system encryption to demand ransom payments. The group operates a dedicated dark-web data-leak site, threatening to publish stolen information when victims do not pay. Orova's claimed victims span multiple countries, including the United States, Malaysia, Singapore, India, Taiwan, and Hong Kong. Named targets include technology companies, industrial suppliers and manufacturers, healthcare businesses, hospitality operators, jewelry retailers, and oil-and-gas support providers. Orova listed 47 alleged victims over 10 posting days during the third quarter of 2026; these listings represent extortion claims rather than independently verified compromises. Its geographic origin and organizational affiliations are not established, and its initial-access methods and ransomware implementation remain insufficiently documented.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.