Osiris

Osiris is a malware name used in the provided content for multiple distinct threats. Most prominently, it refers to a newly observed ransomware family first seen in November 2025 in a targeted attack against a major food service franchisee operator in Southeast Asia. Researchers reported that this ransomware is unrelated to the 2016 Locky variant also called Osiris. In the 2025 intrusion, attackers used living-off-the-land and dual-use tools including Netscan, Netexec, MeshAgent, a modified RustDesk binary disguised as "WinZip Remote Desktop," Mimikatz/kaz.exe for credential dumping, and Rclone to exfiltrate data to Wasabi cloud storage prior to encryption. The operation also used the POORTRY/Abyssworker malicious driver in a BYOVD-style defense evasion technique, including masquerading as a Malwarebytes component, to disable security software; KillAV was also reported in some coverage. The ransomware is full-featured, using hybrid ECC and AES-128-CTR encryption with a unique key per file, supporting partial or full encryption via command-line options, appending the .Osiris extension, deleting Volume Shadow Copies, terminating numerous database, backup, mail, office, browser, and other processes/services, handling Hyper-V-related options, and dropping a ransom note named Osiris-MESSAGE.txt with negotiation links. Reporting noted tactical and tooling overlaps with prior Inc ransomware activity, but attribution remained uncertain.

The content also uses Osiris to refer to a Windows banking malware sample analyzed in August 2019. That sample persisted by adding itself to startup and copying itself to %APPDATA%\Roaming\Microsoft\Windows\Protected\setspn.exe, masquerading as the legitimate Microsoft setspn.exe. It dropped files in %APPDATA%\Roaming and %temp%, used Nullsoft Scriptable Installer components for a headless install, and used a Mini-Tor proof-of-concept implementation to communicate over the Tor network, likely for anonymized data exfiltration. Reported indicators for that sample included SHA-256 0325714eeb2af235a0f543ad9e11b5d852a61be78c9ece308c651412d97edd39 and URLs httpx://naot[.]org/cms/file/fixed111[.]exe and httpx://borel[.]fr/notices/CanadaPost[.]zip.

Separately, the content mentions the publicly available Osiris jailbreak bundled inside the Phenakite iOS surveillance implant used by Arid Viper/APT-C-23. In that context, Osiris is jailbreak code rather than the primary malware itself, and was used by Phenakite to elevate privileges on 64-bit devices running iOS 11.2 to 11.3.1.