orion
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
| Name | Country | Sector | Date |
|---|---|---|---|
| huntongroup.com | GB | Professional Services | 2026-08-05T20:05:09.929703+00:00 |
| hphood.com | US | Other | 2026-08-05T20:04:26.917670+00:00 |
| bridgestoneamericas.com | US | Manufacturing | 2026-08-05T20:03:43.313337+00:00 |
| albanybank.com | US | Financial Services | 2026-08-05T20:02:59.730815+00:00 |
| ipsenlogistics.com | — | Transportation | 2026-08-05T20:02:18.406487+00:00 |
| hetero.com | — | Healthcare | 2026-08-05T20:01:55.469075+00:00 |
| sitrack.com | DE | Transportation | 2026-08-05T20:01:12.418771+00:00 |
| kioti.com | US | Agriculture and Food Production | 2026-08-05T20:00:50.019765+00:00 |
| udhaiyamdhall.com | IN | Retail & E-Commerce | 2026-08-05T20:00:08.663755+00:00 |
| emanic.net | DE | Technology | 2026-08-05T19:59:38.790231+00:00 |
| daubertchemical.com | US | Manufacturing | 2026-08-05T19:59:00.476086+00:00 |
| morrisgroupint.com | GB | Professional Services | 2026-08-05T19:58:32.074054+00:00 |
| pricemodern.com | — | Retail & E-Commerce | 2026-08-05T19:57:47.059093+00:00 |
| Nitrex Chemicals India | IN | Manufacturing | 2026-08-05T19:57:11.123023+00:00 |
Data from ransomware.live