Ransomware Group intelligence
Orova
ActiveTrack Orova with 56 published victims and 4 known leak locations in a single intelligence view.
Overview
Orova is tracked by Dark Eye as a ransomware group with 56 published victims.
United States is currently the most targeted country in this dataset.
4 known leak locations are currently associated with this group.
Leak Status Distribution
- Leaked 23 41.1%
- Pending 32 57.1%
- Deleted 1 1.8%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (4)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Up checked 4h ago | mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion |
| Leak location 4 | Onion service | Up checked 4h ago | maa2yprc5pldyr5hjn246hw7i66wdhglnostqgqkcbuh4vyyeos4xxyd.onion |
| Leak location 3 | Onion service | Up checked 4h ago | ns7y6bxawualjj5rpo5num6syejd7hgaowrndk3r4duxu2iyinzv6hid.onion |
| Leak location 1 | Onion service | Up checked 4h ago | mzlajyncb2rafn5bsb7esmo73kyawjxeirunba27n6nermmafzlcp4qd.onion |
Top Activity Sectors (13)
- Construction / Real Estate 10
- IT 9
- Manufacturing / Engineering 8
- Healthcare / Pharma 5
- Education 3
- Retail / E-commerce 3
- Transportation / Travel / Logistics 2
- NGOs / Associations 2
- Finance / Legal / Insurance 2
- Services 1
- Hospitality / Food & Beverage / Tourism 1
- Agriculture / Food 1
- Not identified 1
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Orova, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Orova executes malicious payloads via PowerShell scripts to deploy ransomware and evade detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Orova disables antivirus tools and security software using command-line utilities to ensure full system access.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Orova deletes Volume Shadow Copies and backup files via vssadmin and built-in Windows commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: Orova uses network share discovery to locate victim file shares and target critical directories for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1560.001 Archive via Utility Collection
What they do: Orova archives stolen data using utility tools prior to exfiltration to support extortion demands.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: Orova exfiltrates victim data over C2 channels before deployment to enable ransomware-as-a-service extortion.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: Orova encrypts victim files using strong symmetric encryption, targeting business documents and backups across affected systems.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Orova inhibits system recovery by terminating critical Windows services like backup agents and endpoint security processes.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (56)
Search, filter and paginate the victim timeline for Orova. Showing 1–56 of 56.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Wah Chan Consolidated Sdn Bhd id35462 View details | Malaysia | Services | leaked | ||
|
Wah Chan Consolidated Sdn Bhd Jewelry & Watch Retail Company URL| Oct 23, 2026 429,222 files|224.90 GB|Watch Data |
||||||
| Ransomware | Trevi Technology id35463 View details | Taiwan, Province of China | Transportation / Travel / Logistics | leaked | ||
|
Trevi Technology Software Company URL| Oct 23, 2026 29,034 files|435.87 GB|Watch Data |
||||||
| Ransomware | Durga Bearings id33813 View details | India | — | pending | ||
|
Today Durga Bearings, we're proud to be the leading supplier of top-quality bearings in the country. With a wide range of products from world-renowned brands like NSK-RHP, INA,FAG, THK, BMD, GRW and many more we ensure our customers have access to over 150,000 types of bearings. |
||||||
| Ransomware | Codar (Pte) Ltd id33814 View details | Singapore | — | pending | ||
|
As one of the pioneers specializing in marine radio communications and navigational equipment, Codar Pte Ltd provides a one-stop solution with seamless services and supply of marine electronics products and spares to our customers in the region. |
||||||
| Ransomware | Alfameli Group id33815 View details | Malaysia | — | pending | ||
|
Alfa-Meli Sdn Bhd (Alfameli Group) is a Malaysian privately owned company specializing in oil and gas support services, particularly offshore catering, facilities management, manpower supply, and industrial services. |
||||||
| Ransomware | The Park Lane Hong Kong id33789 View details | Hong Kong | — | pending | ||
|
The Park Lane Hong Kong, Autograph Collection - A Signature Hotel in the Marriott Bonvoy Collection - blends heritage with the city’s modern spirit, letting you enjoy business, leisure, and connection — all just moments from the city’s best. |
||||||
| Ransomware | Libre Wireless Technologies id33790 View details | India | — | pending | ||
|
Explore our certified platforms, ranging from MAVID, renowned for being the industry's most integrated, energy-efficient, and compact MIC-to-cloud IoT devices to LS9 platforms, offering extensive capabilities as multi-ecosystem voice assistants and music streamers with the latest features. |
||||||
| Ransomware | Amantya Technologies id33791 View details | India | — | pending | ||
|
Amantya brings together deep expertise in AI, software, data, cloud, telecom, GIS, and digital engineering to help enterprises transform how they build, operate, and grow. |
||||||
| Ransomware | Gatetech Technology id33792 View details | Taiwan, Province of China | — | pending | ||
|
Gatetech have dedicated light metal casting industry for over 20 years, be able to offer one stop service from casting till assemble in house for aluminum alloy and magnesium alloy both raw materials, major casting machines imported from Europe. USA and Japan, such as Toshiba, Toyo, Frech, Bulher. |
||||||
| Ransomware | Siddhi Green Excellence Pvt. Ltd id33014 View details | India | Education | leaked | ||
|
Our journey started in 2001 with baby steps like – treatability studies, general analysis of chemicals, water and wastewaters and providing technical consultancy for CC&A and NOC applications of chemical industries; and eventually, Siddhi Green expanded to offer a wide spectrum of environmental services under one roof with systematic planning and a quality-oriented approach. |
||||||
| Ransomware | Euramex Management Group id33011 View details | United States | IT | leaked | ||
|
Avila Real Estate, LLC is a vertically-integrated multifamily company, adding value through acquisition, development of land, construction and operating residential assets. Headquartered in Atlanta, Georgia, Avila has developed over $800 million in 25 multifamily transactions since 1986 for its own account and on behalf of global and institutional investors. |
||||||
| Ransomware | ASYS Corporation id32354 View details | Taiwan, Province of China | Manufacturing / Engineering | leaked | ||
|
ASYS has been dedicated to providing instrument agency services for semiconductor technology factories and developing services such as facility system integration engineering. With years of technical accumulation, we have also successfully developed proprietary products, including yield improvement equipment and industrial IoT-related sensors. |
||||||
| Ransomware | Fu Sheng Industrial Co., Ltd id32355 View details | Hong Kong | IT | leaked | ||
|
The company was initially built from the ground up, and it overcame daunting challenges to gain a foothold in Taiwan, where it specialized in overhauling all types of air compressors made in European countries, the United States of America, and Japan. |
||||||
| Ransomware | ITC Properties Group Limited id32261 View details | Hong Kong | Construction / Real Estate | leaked | ||
|
ITC Properties is an investment holding company and the Group is principally engaged in development of, selling of and investment in properties in Macau, Hong Kong, the People's Republic of China (the "PRC") and Canada; securities investments and provision of loan financing services. |
||||||
| Ransomware | South Pacific Hotel Limited id32259 View details | Hong Kong | Hospitality / Food & Beverage / Tourism | leaked | ||
|
The hotel has a unique glass curtain wall and an oval building appearance. The building is 28 floors high, with 293 rooms and suites. |
||||||
| Ransomware | Central Florida Civil LLC id32131 View details | United States | Construction / Real Estate | deleted | ||
|
Central Florida Civil, a leading name in underground utilities and site development based in the vibrant city of Belleview, Florida. With a strong foundation built on professionalism, we are dedicated to delivering exceptional service. Demolition, Earthwork, Fire Suppression, General Construction Management. |
||||||
| Ransomware | Arich Enterprise Co., Ltd. id32132 View details | Taiwan, Province of China | IT | leaked | ||
|
Currently, our end customers include over 12,000 establishments, such as medical centers, regional hospitals, area hospitals, clinics, chain pharmacies, standalone pharmacies, and hyper market channels. We have created a robust pharmaceutical marketing service system and become the largest domestic company in this field. |
||||||
| Ransomware | Bai-chi CPA Firm id32133 View details | Taiwan, Province of China | IT | leaked | ||
|
Bai-chi CPA Firm is a registered Taiwanese CPA practice. |
||||||
| Ransomware | DL HOLDINGS GROUP id31889 View details | Hong Kong | — | leaked | ||
|
Our team has taken: 1. Confidential financial records, including unaudited earnings reports, tax filings, and executive compensation details. 2. Internal communications (emails, database, etc.) revealing potential regulatory violations, undisclosed partnerships. 3. Customer and employee PII (Personally Identifiable Information), including passport scans, employment contracts, and NDA-protected agreements. 4. Board meeting minutes and strategic planning documents. 5. Cryptocurrency Investment Plans and progress reports |
||||||
| Ransomware | Smartsoft id31741 View details | Taiwan, Province of China | IT | leaked | ||
|
Say goodbye to cumbersome and difficult-to-maintain traditional architectures and regain control of your processes. Redefine enterprise standards with the high performance and low-code platform of .NET 8. |
||||||
| Ransomware | Ganzhou Xinye Craft Co., Ltd. id31572 View details | Hong Kong | Manufacturing / Engineering | leaked | ||
|
Ganzhou Xinye Art and Craft Co., Ltd. is a large-scale craft gift production enterprise affiliated to Xinlin Group. The company was established in September 1997. It is a large foreign-owned enterprise with a total investment of 7.2 million US dollars. It mainly produces resin, glass, clay, ceramics, water globe and other handicrafts, all products are exported to the United States, Canada, Britain and other European and American countries. |
||||||
| Ransomware | First Baptist Church of Belleview id31373 View details | United States | NGOs / Associations | leaked | ||
|
First Baptist Church Belleview is dedicated to fostering devoted followers of Jesus Christ through worship and community engagement. They offer Sunday services at 10:45 a.m. and provide opportunities for learning and connection through various ministries and events. |
||||||
| Ransomware | Hilliard's Air Conditioning & Heating Inc id31368 View details | United States | Construction / Real Estate | leaked | ||
|
Since 1988 customers have trusted Hilliard's Air Conditioning & Heating, Inc. as their air conditioning and heating specialist. As a family run business, Hilliard's takes great pride in serving Central Florida and is state licensed and insured. |
||||||
| Ransomware | Gemstone UK id31369 View details | United States | Retail / E-commerce | leaked | ||
|
Gemstone UK was a company that operated for over 30 years before closing its doors. It served a diverse clientele, providing products and services related to gemstones. The company expressed gratitude to its loyal customers for their trust and support throughout the years. |
||||||
| Ransomware | St Theresa Catholic Church id31358 View details | United States | Education | pending | ||
|
Today we have broadened our network and capability to provide services by partnering with other individuals, groups and churches through the Belleview Area Social Services (BASS) Network. BASS works to bring a coordinated approach to providing services to those in need. |
||||||
| Ransomware | Stoneybrook West Master Association, Inc id31359 View details | United States | Construction / Real Estate | leaked | ||
|
At Stoneybrook West, we plan regularly scheduled group physical fitness and after school classes, personal fitness training, swimming classes, tennis instruction, and music lessons are just to name a few. |
||||||
| Ransomware | Stonecrest POA id31360 View details | United States | Construction / Real Estate | leaked | ||
|
Stonecrest POA is the mandatory property owners association for Stonecrest, a large gated 55+ residential community in Summerfield, Marion County, Florida. It is a nonprofit community-governance organization, not a conventional profit-making company. |
||||||
| Ransomware | Magnolia Dental id31362 View details | United States | Healthcare / Pharma | leaked | ||
|
Our practice is dedicated to providing exceptional dental services to Summerfield, FL, and the surrounding areas. As a patient-centered practice, we treat you like family, prioritizing your comfort and well-being above all else. |
||||||
| Ransomware | Country Oaks Veterinary Clinic id31363 View details | United States | Retail / E-commerce | leaked | ||
|
Country Oaks Veterinary Clinic is a full-service hospital established in 1976. We provide high-quality veterinary care in a modern, welcoming environment. Our experienced doctors and staff treat your pets like family. |
||||||
| Ransomware | David King Architect id31364 View details | United States | Construction / Real Estate | leaked | ||
|
We are an Architectural Firm and Design and prepare plans for almost any low rise structure. We have designed Assisted Living Facilities, Offices, Warehouses, manufacturiing facilities and Car dealerships. |
||||||
| Ransomware | Woodside Ranch id31365 View details | United States | Construction / Real Estate | leaked | ||
|
Bryan and Holley Beattie Rice own and operate Woodside Ranch, a family run Thoroughbred Training Center in Ocala, Florida. Our motto is hard work and attention to detail. We are committed to giving young prospects the best possible start. We take great pride in our relentless effort to advance our methods and our facilities. |
||||||
| Ransomware | FixIT Tek id31246 View details | United States | IT | pending | ||
|
Providing the best possible IT services to businesses of all sizes in Central Florida and Surrounding Areas. ##### FixIT Tek's Syncro MSP panel has been hacked and stolen big data of many clients from their network. ##### |
||||||
| Ransomware | ADG Healthcare id31224 View details | Egypt | Healthcare / Pharma | pending | ||
|
ADG Healthcare is a company that operates in the Medical Specialists industry. It employs 250to499 people and has 10Mto25M of revenue. The company is headquartered in Cairo, Cairo, Egypt. |
||||||
| Ransomware | eSysTech id31225 View details | Brazil | IT | pending | ||
|
The company offers customized software solutions and develops new modules and platforms to enhance IT asset management. Its main product, ADOTI, provides comprehensive tools for tracking and managing IT resources, serving clients across various sectors, including Votorantim Cimentos and Unimed. eSysTech has established partnerships with multiple companies to deliver its services effectively. |
||||||
| Ransomware | Northeastern Communications & Electrical id31226 View details | United States | Construction / Real Estate | pending | ||
|
Northeastern Communications & Electrical LLC, based in Middletown, Connecticut, specializes in the installation of voice, data, and video systems for various building types, including small, medium, and large-scale projects. The company prides itself on delivering high-quality and professional services, backed by years of technical expertise. |
||||||
| Ransomware | Apollo Office System id31227 View details | Japan | IT | pending | ||
|
Since our establishment in May 1970 as an office equipment sales company, we have provided one-stop services to propose office rationalization and a more comfortable office environment. |
||||||
| Ransomware | EMPYREAN INT’L TECHNO DEVICES id31228 View details | Taiwan, Province of China | IT | pending | ||
|
Taiwan-based telecom and electronics accessories company. They specialize in wearable accessories, such as digital watches and related gear. |
||||||
| Ransomware | Texas Medical Screening id31229 View details | United States | Healthcare / Pharma | pending | ||
|
Texas Medical has helped organizations deliver health screenings without the overhead. Our self-service kiosks are trusted in workplaces, pharmacies, and community spaces across the country. |
||||||
| Ransomware | Sc Regional Housing Authority id31230 View details | United States | NGOs / Associations | pending | ||
|
SCRHA3 provides affordable housing solutions across South Carolina, focusing on public housing, homeownership, and rental assistance programs. With over 15 years of experience, they offer subsidized housing assistance to qualified families and help low-income families access the private rental market through the Section 8 program. |
||||||
| Ransomware | Bjs Insurance & Financial id31231 View details | United States | Finance / Legal / Insurance | pending | ||
|
BJS Insurance Services, Inc. was established upon two underlying principles that continue to define the company today.... Integrity and Stability. We're all about Service, we just do what we say we're going to do. We listen to our clients and suggest what plans fit your needs and budget. |
||||||
| Ransomware | Wisdom Oral Surgery id31232 View details | United States | Healthcare / Pharma | pending | ||
|
Wisdom Oral Surgery, located in Fair Lawn, NJ, specializes in a wide range of oral surgery services including dental implants, wisdom teeth extractions, bone grafting, and facial trauma care. The clinic is dedicated to providing exceptional patient comfort and care, utilizing advanced technology for accurate diagnoses and treatments. |
||||||
| Ransomware | SURE TRAVEL COMPANY id31233 View details | Hong Kong | Transportation / Travel / Logistics | pending | ||
|
SURE TRAVEL COMPANY LIMITED was incorporated on 24-JAN-2000 as a Private company limited by shares registered in Hong Kong.@ |
||||||
| Ransomware | SBI Manufacturing id31208 View details | United States | Manufacturing / Engineering | pending | ||
|
SBI Manufacturing is a family-owned company based in Sioux Falls, SD, specializing in metal fabrication and machine welding. They provide services primarily to the agricultural, industrial, and transportation sectors. |
||||||
| Ransomware | Agricultural Chemical Solutions id31209 View details | United States | Agriculture / Food | pending | ||
|
Agricultural Chemical Solutions, Inc. provides high-quality agricultural chemicals and a comprehensive marketplace aimed at enhancing farming operations. They offer a wide range of products including pesticides, herbicides, fungicides, and micro nutrients, with competitive pricing and expert recommendations. |
||||||
| Ransomware | DBM Reflex id31210 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
DBM Technology Co., Ltd. is a leading brand in electroforming mold cores in Asia, established in 1999. With a team of over 70 professionals, the company specializes in mold core design and high-quality electroformed mold production, having produced more than 9,000 sets to date. Their services include feasibility assessments, optical design, mold core structure design, product testing, and light distribution testing, making them a preferred choice in the automotive industry. |
||||||
| Ransomware | Ultra Fame id31211 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
As PCB design continues to evolve in complexity and customization, we believe that outstanding circuit layouts are built on a strong engineering foundation and a deep understanding of our clients’ needs. From simple double-layer boards to advanced multi-layer high-speed signal boards, we approach every project with professionalism and deliver reliable, high-quality layouts our clients can count on. |
||||||
| Ransomware | Cardiology Associates id31212 View details | United States | Healthcare / Pharma | pending | ||
|
Serving the community for over 45 years, Cardiology Associates of Port Huron, P.C. offers the latest in cardiac procedures and technology, helping our qualified physicians to detect and provide comprehensive treatment for a wide variety of adult heart and artery conditions. |
||||||
| Ransomware | Yost Home Improvements id31213 View details | United States | Construction / Real Estate | pending | ||
|
Yost Home Improvements is a family-owned exterior remodeling and construction company based in Waterford, Connecticut, serving the southeastern CT region for over 50 years. They specialize in installing vinyl siding, windows, doors, gutters, roofing, and sunrooms. |
||||||
| Ransomware | KINGSSON id31214 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
KINGSSON primarily operates as an OEM/ODM manufacturer, supplying customized security sealing products under customers' own brands. The company markets mainly to distributors and industrial customers rather than retail consumers. |
||||||
| Ransomware | SSI HOLDING (FAR EAST) LIMITED id31215 View details | Hong Kong | Other | pending | ||
|
AIMING at streamlining all aspects of business, procuring excellent quality of management and strengthening connexion of our well established affilated companies, S.S.I. Holding (Far East) Limited was found in November of 1995 with association of Simex Sport GmbH, a German base corporation of over 30 years experience in sport related business when inception. |
||||||
| Ransomware | Sanrio Hong Kong Co., Ltd id31216 View details | Hong Kong | Retail / E-commerce | pending | ||
|
Sanrio is the global lifestyle brand best known for Hello Kitty who was created in 1974, and home to many other beloved character brands such as My Melody, Kuromi, Little Twin Stars, Cinnamoroll, Pompompurin, gudetama, Aggretsuko, Chococat, Bad Badtz-Maru and Kerokerokeroppi. |
||||||
| Ransomware | Tat Fung Textile Co., Ltd. id31217 View details | Hong Kong | Manufacturing / Engineering | leaked | ||
|
Tat Fung & Panther Denim is a premium woven, denim, and print fabric mill established in 1986. The company specializes in producing high-quality denim and print fabrics, focusing on sustainability and innovation. |
||||||
| Ransomware | Integrated Site Management id31218 View details | United States | Education | pending | ||
|
Integrated Site Management is a full service site consulting company with our foundation reinforced by developing partnerships with clients, vendors & suppliers. Partnerships built from professionalism, honesty, integrity, respect, and open communication. Integrated Site Management listens, researches, identifies, and then provides solutions for our clients needs. |
||||||
| Ransomware | Conceptual Designs, Inc. id31219 View details | United States | Construction / Real Estate | pending | ||
|
Conceptual Designs, Inc. proudly provides interior design services for businesses across the Quad Cities from our studio in Bettendorf, Iowa. No matter what kind of business you own, we can help make your space match your company’s culture and values in a creative way. With over 35 years of experience, our team of designers can help bring your vision to life. |
||||||
| Ransomware | JK Capital Management Limited id31220 View details | Hong Kong | Finance / Legal / Insurance | pending | ||
|
JK Capital Management Limited is an asset management company set up in Hong Kong in 1997 and regulated by the Securities and Futures Commission of Hong Kong. We are GIPS and MIFID II compliant. Our mutual funds are all registered with CSSF, the Luxembourg regulator. |
||||||
| Ransomware | Global Friction Products, Inc id31221 View details | United States | Manufacturing / Engineering | pending | ||
|
GLOBAL FRICTION PRODUCTS, INC is a company that manufactures, repairs, and /or re-arcs brake and clutch bands back to original drum for even wear on friction material. We specialize in the construction, mining, marine and offshore industries, i.e., cranes, draglines, clamshells, barges, dredges, ships, tugs, winches and more. |
||||||