Unveiling the New Osiris Ransomware: A Rising Threat
Cybersecurity researchers have recently identified the emergence of a new ransomware family named Osiris, marking a significant addition to the roster of digital threats. The malware first made headlines in late November 2025 when it targeted a major food service franchisee in Southeast Asia. Drawing attention for its deployment techniques, Osiris leverages a malicious driver known as POORTRY in a sophisticated attack vector known as Bring Your Own Vulnerable Driver (BYOVD), designed to disarm security measures and pave the way for a damaging attack.
Understanding Osiris: Technical Capabilities and Operation
Distinct from the infamous 2016 Locky ransomware, the current Osiris lacks direct lineage to its namesake. Analysts believe it couldn't be linked to any known ransomware family or advertised under the typical Ransomware-as-a-Service (RaaS) model. The unique operations of Osiris suggest it could be a product of seasoned operators, evidenced by its effective encryption methods which apply a hybrid encryption scheme using AES-128.
The ransomware is designed to disable numerous critical processes directly linked to productivity and communication tools, and not solely computer security applications. This includes attacks on services like Microsoft Office and various database systems such as SQL and MySQL. Furthermore, the attacks typically begin with data exfiltration, where sensitive files are first sent to cloud storage buckets before the ransomware payload is executed.
Links to Previous Threats: Is Osiris Part of a Larger Network?
Intriguingly, the investigators from Symantec and Carbon Black suggest that clues in the Osiris code may point to potential affiliations with the INC ransomware group, also noted for its sophisticated attacks. Evidence indicates that both Osiris and INC share common operational tools like the Mimikatz credential theft tool and methods for cloud-based data exfiltration.
The malicious POORTRY driver utilized not only serves to facilitate the ransomware's operations but is also emblematic of a shift within the ransomware threat landscape, where attackers increasingly develop bespoke drivers designed explicitly for malicious use, further engaging in advanced evasion tactics.
Increasing Ransomware Incidents: An Ongoing Global Concern
The landscape of ransomware attacks continues to evolve, with ransomware incidents—including those linked to Osiris—growing in prevalence. Data indicates a slight rise in ransomware incidents from 2024 to 2025, alongside the emergence of new and sophisticated tactics. With actors like Akira, Qilin, and now Osiris appearing in reports, organizations need to remain vigilant and enhance their defenses.
What Can Organizations Do?
In light of emerging threats like Osiris, organizations are urged to adopt a proactive approach towards cybersecurity. This includes implementing multi-factor authentication, restricting access to vulnerable systems, and reinforcing their disaster recovery plans. Furthermore, staying informed about the latest cybersecurity threats and vulnerabilities can be critical in preventing devastating breaches.
In conclusion, the rise of the Osiris ransomware serves as a stark reminder of the continuous and evolving nature of cyber threats. As technology advances, so too does the sophistication of cybercriminals, emphasizing the need for ongoing vigilance and adaptability in cybersecurity strategies.
Write A Comment