Derp.ca
Ransomware group

Orion

Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.

Profile source: Ransomware.live opens in a new tab

Orion

Family profile

Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.

Ransomware.live

Operational record

View group record ↗
1
YARA rules
1
Leak sites
1 available

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE opens in new tab Tria.ge opens in new tab IPinfo opens in new tab urlscan.io opens in new tab eCrime.ch opens in new tab Mallory opens in new tab