osiris
Activity analysis
HackerFeeds has tracked 3 victims claimed by osiris since December 2025, most recently in January 2026 — ranking #285 of 332 groups (0% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in January 2026. Its most-targeted sector is Technology (1 victims), followed by Manufacturing (1). The United States accounts for 1 victims (33% of those with a known location).
Victims per year
- 20251
- 20262
Top sectors
- Technology1
- Manufacturing1
- Hospitality and Tourism1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Osiris is a ransomware-as-a-service operation first observed in November 2025 that uses a Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint detection tools before deploying hybrid ECC + AES-128-CTR encryption; Symantec researchers linked its operators to former INC ransomware affiliates.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2026-01-09 |  American Vanguardamerican-vanguard.com | Manufacturing | US |
| 2025-12-10 |  The Araneta Grouparanetacity.com | Hospitality | PH |