orion
Activity analysis
HackerFeeds has tracked 14 victims claimed by orion since October 2025, most recently in July 2026 — ranking #198 of 332 groups (0% of all tracked ransomware victims). It posted 0 victims in the last 90 days, down 100% on the previous 90 days (1). Its most-targeted sector is Manufacturing (3 victims), followed by Transportation (2). The United States accounts for 5 victims (45% of those with a known location); 3 victims did not disclose a location.
Victims per year
- 202513
- 20261
Top sectors
- Manufacturing3
- Transportation2
- Retail & E-Commerce2
- Professional Services2
- Technology1
- Other1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Recent victims
No victims tracked yet.