Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Orion
As of Oct 19, 2026, Orion has listed 27 confirmed victims on its leak site since Oct 28, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (66.7% of its victims) and its most targeted sector is Manufacturing.
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 27
- Rank By Victims
- #146
- Last Leak-Site Post
- Aug 5, 2026
- Top Country
- United States
- Top Sector
- Manufacturing
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 1 |
| August 2026 | 13 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 1 |
| August 2026 | 13 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| October 2025 | 13 |
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 1 |
| August 2026 | 13 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Orion Victims.
Search all 27 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| huntongroup.com huntongroup.com | USUnited States | Construction | Not stated | |
| hphood.com hphood.com | USUnited States | Food and Beverage | Not stated | |
| bridgestoneamericas.com bridgestoneamericas.com | USUnited States | Transportation and Logistics | Not stated | |
| albanybank.com albanybank.com | USUnited States | Financial Services | Not stated | |
| ipsenlogistics.com ipsenlogistics.com | DEGermany | Transportation and Logistics | Not stated | |
| hetero.com hetero.com | INIndia | Pharmaceuticals | Not stated |
How They Operate.
Orion's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Orion Targets.
Sectors
History.
Busiest month on record: 13 confirmed victims
First confirmed victim listed on its leak site
Most recent leak-site post
First seen in Brandefense data
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.