All ransomware groups
orion
14 tracked victims
·first seen 2025-10-28·last activity 2026-07-27Group profile
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2025-10-28 |  huntongroup.comhuntongroup.com | Professional Services | GB |
| 2025-10-28 |  hphood.comhphood.com | Other | US |
| 2025-10-28 |  bridgestoneamericas.combridgestoneamericas.com | Manufacturing | US |
| 2025-10-28 |  albanybank.comalbanybank.com | Financial Services | US |
| 2025-10-28 |  ipsenlogistics.comipsenlogistics.com | Transportation | |
| 2025-10-28 |  hetero.comhetero.com | Healthcare | |
| 2025-10-28 |  sitrack.comsitrack.com | Transportation | DE |
| 2025-10-28 |  kioti.comkioti.com | Agriculture and Food Production | US |
| 2025-10-28 |  udhaiyamdhall.comudhaiyamdhall.com | Retail & E-Commerce | IN |
| 2025-10-28 |  emanic.netemanic.net | Technology | DE |
| 2025-10-28 |  daubertchemical.comdaubertchemical.com | Manufacturing | US |
| 2025-10-28 |  morrisgroupint.commorrisgroupint.com | Professional Services | GB |
| 2025-10-28 |  pricemodern.compricemodern.com | Retail & E-Commerce | |
| 2026-07-27 |  Nitrex Chemicals Indiawww.nitrex.in | Manufacturing | IN |