The initial supply chain attack was conducted through a piece of software called Orion, an IT network monitoring tool developed by a company called SolarWinds.
Orion
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Profile source: Ransomware.live opens in a new tabOrion
Family profile
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Operational record
1
YARA rules
1
Leak sites
1 available
Recent claims
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
