osiris ransomware group
Osiris is a ransomware-as-a-service operation first observed in November 2025 that uses a Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint detection tools before deploying hybrid ECC + AES-128-CTR encryption; Symantec researchers linked its operators to former INC ransomware affiliates.
- Claims in 7 days
- 8
- Claims in 30 days
- 8
- Reported techniques
- 0
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| United States | 5 |
| Germany | 2 |
| United Kingdom | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Healthcare | 3 |
| Manufacturing | 2 |
| Professional Services | 1 |
| Technology | 1 |
| Transportation | 1 |