RansomwareFinancial
Orion
Orion is a ransomware group with a financial motive, tracked by Brandefense. It targets 10 sectors, including Technology and Manufacturing, in 4 countries, including the United States and India.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Oct 28, 2025
- Last seen
- Aug 5, 2026
- Record updated
Who They Target.
About Orion.
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.