Loading story…
Security researchers reported a new ransomware family, Osiris, used in an intrusion against a major food service franchisee/operator in Southeast Asia. The activity was observed in November 2025 and is assessed to involve a brand-new Osiris strain unrelated to the similarly named 2016 ransomware (linked to Locky). The operators used a broad set of living-off-the-land and dual-use tools to move through the environment, establish persistence, and deploy an encryption payload designed for operational flexibility (e.g., stopping services, terminating processes, targeting specific folders/extensions, and dropping a ransom note).
A key capability in the intrusion was a bring-your-own-vulnerable-driver (BYOVD) defense-evasion technique using the POORTRY driver (also referred to as Abyssworker), which masqueraded as legitimate software to help disable security controls. The attackers also performed data theft prior to encryption, using Rclone to exfiltrate data to Wasabi cloud storage buckets, and leveraged credential-dumping tooling including Mimikatz (noted as kaz.exe). Analysts highlighted technical overlaps with prior INC ransomware activity (aka Warble), including similar tool naming and exfiltration patterns, suggesting a possible relationship between the Osiris operators and actors previously associated with INC ransomware campaigns.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In the January 2026 disclosure, researchers said Osiris showed tooling and tradecraft overlaps with the INC (Warble) ransomware ecosystem, including shared exfiltration patterns and a Mimikatz variant named kaz.exe. They stopped short of firm attribution, noting the similarities could reflect imitation or affiliate crossover.
On January 22, 2026, Symantec and VMware Carbon Black researchers publicly reported Osiris as a distinct new ransomware strain unrelated to the older 2016 'Osiris' Locky variant. They described its use of living-off-the-land tools, hybrid ECC plus AES-128-CTR encryption, and selective or full encryption options.
In the same attack, the threat actors deployed the POORTRY (Abyssworker) malicious driver in a bring-your-own-vulnerable-driver technique to terminate or disable endpoint security products. Reports also noted use of KillAV and other dual-use tools for defense evasion.
During the November 2025 intrusion, the operators stole data prior to encryption, using Rclone to upload files to Wasabi cloud storage. This established the incident as a double-extortion style attack.
In November 2025, a newly identified ransomware family later named Osiris was used in an attack against a major food service franchise operator in Southeast Asia. The intrusion involved a human-operated campaign targeting a large enterprise victim.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcethecyberthrone.in
Open sourcecommunity.opentextcybersecurity.com
Open sourcecybersecuritynews.com
Open sourceradar.offseq.com
Open sourcethehackernews.com
Open sourcesiliconangle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026
Arctic Wolf reported multiple 2026 intrusions tied to the **Anubis** ransomware-as-a-service operation in which affiliates gained initial access through abused VPN credentials and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on NetScaler ADC and Gateway systems. The intrusions then progressed through lateral movement over **RDP** and **SMB**, credential harvesting, use of **PsExec**, and efforts to reduce security visibility before ransomware was deployed and files were encrypted with the `.anubis` extension. Investigators said the attackers relied heavily on legitimate remote management, tunneling, and data-transfer tools during the pre-encryption phase, including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, cloudflared, SSH tunnels, rclone, s5cmd,** and **S3 Browser**. The activity shows Anubis affiliates blending living-off-the-land techniques with benign-looking administration software to stage data and maintain access, giving defenders an opportunity to detect attacks earlier by treating unusual clusters of remote-access, credential, tunneling, and cloud-transfer behavior as signs of compromise rather than routine IT activity.
Jul 8, 2026