Moderate Ransomware / Double Extortion Active TLP:CLEAR

Orova

Leak site launched August 2026 with a backlog of 47 claimed victims. Linux/ESXi encryptor confirmed by SonicWall sample analysis. Unusual concentration of Hong Kong and Taiwan victims.

04 AUG 2026

LEAK SITE INDEXED

CLAIMED VICTIMS

COUNTRIES (AS TAGGED)

18 / 37

HK + TW VICTIMS, ALL GROUPS

01· EXECUTIVE ASSESSMENT

New leak site, old intrusions, and a working ESXi encryptor

THREAT: MODERATE · ATTRIBUTION CONFIDENCE: LOW · UNCLUSTERED / NO GOVERNMENT OR VENDOR ATTRIBUTION

WHAT

Orova is a financially motivated ransomware and data-extortion group. Its Tor leak site was first indexed on 04 August 2026. [4] Intruvent collection records 47 claimed victims between 04 August and 20 September 2026 (45 in August, 2 in September). [1] The group describes itself as a start-up ransomware-as-a-service (RaaS) operation and has claimed to be a branch of an earlier group that disappeared; neither claim has been independently verified, and no reviewed source identifies the claimed predecessor. [4][7] SonicWall Capture Labs analyzed an Orova encryptor on 28 August 2026: a 90 KB statically linked ELF binary for Linux servers and VMware ESXi hypervisors that force-kills running virtual machines and encrypts files with Curve25519, ChaCha20, and SHA-256. [6] Orova is not present in the Intruvent Golden CTI Database (Codex) as of 24 September 2026. [2]

SO WHAT

Twenty-four victims appeared on the first day of indexing and 35 within three days. [1] Tracker data puts the earliest estimated attack date at 03 May 2026 and the average gap between estimated attack and leak-site posting at 37.8 days. [3] Assessment (moderate confidence): this pattern is consistent with a backlog of earlier intrusions published at leak-site launch, not with 24 same-day compromises. The victim mix is unusual. Of 37 Hong Kong and Taiwan victims posted by all groups in Intruvent collection between 04 August and 21 September 2026, Orova accounts for 18 (49%), while it accounts for 47 of 1,678 victims (2.8%) overall. [1] Healthcare is the largest named sector tag (6 victims: five US, one Egypt). [1]

NOW WHAT

Organizations running VMware ESXi should confirm management interfaces are not reachable from general user networks, that ESXi Shell and SSH are disabled when not in use, and that backups of virtual machines are immutable or offline. Tracker reporting assesses valid accounts as the probable entry technique, so remote-access credential hygiene and MFA come first. [3][4] Organizations in Hong Kong and Taiwan, healthcare providers, and managed service provider (MSP) clients should treat Orova as a tracking priority. The onion and Tox indicators in Section 06 are for monitoring and intelligence correlation only; none is suitable for network blocking.

The MODERATE rating reflects a sample-confirmed ESXi encryptor set against a short, mostly small-organization victim record and no published intrusion forensics. A rating upgrade is warranted if posting volume sustains above the August launch level, if Windows-variant or intrusion analysis reveals capability beyond commodity ransomware, or if a shared access source behind the Florida cluster (Section 03) is confirmed. Victim listings in this report are leak-site claims unless stated otherwise. Bracketed markers, e.g. [1], point to the numbered sources in Section 08.

02· ATTRIBUTION & IDENTITY

Unclustered and unattributed; trackers disagree on when it began

ATTRIBUTION

None. No government advisory, MITRE Group entry, or vendor cluster designation for Orova was found in reviewed sources. Codex returns no actor, alias, or malware record. [2][7] Geographic origin: not publicly documented as of 24 September 2026. [7] · LOW CONFIDENCE

LINEAGE CLAIM

Unverified self-claim. The group has claimed to be a branch of an earlier crew that disappeared. [4] Mallory.ai states that no reliable public attribution establishes the identity of that earlier group. [7] Proven Data reports no confirmed links to known groups. [4] Intruvent has found no evidence supporting or refuting the claim.

OPERATING MODEL

Self-described start-up RaaS (unverified claim). [4][7] SonicWall notes a hardcoded per-victim login code in the sample, which it assesses as consistent with a RaaS affiliate model. [6] WatchGuard classifies the group as a "Data Broker" and lists direct extortion, double extortion, and free data leaks as extortion methods. [5]

FIRST OBSERVED

Sources disagree. Proven Data: leak site discovered 04 August 2026. [4] Intruvent collection: first victim posting 04 August 2026. [1] Earliest estimated attack date 03 May 2026, group first seen 07 July 2026 (ransomware.live). [3] Intruvent collection: group record first created 27 July 2026. [1] "May 2026" (WatchGuard, Mallory.ai). [5][7] "August 2026" (Breachsense, Darkfield). [8][9] GalaxyWarden states the group "emerged in late 2025," attributing this to unnamed public reporting. [10] Intruvent found no primary source supporting a 2025 start date.

MOTIVATION

Financial. Double extortion: data theft and encryption, with payment demanded for decryption and non-publication. [5][7] The ransom note sets a 72-hour deadline. [4][6]

SOPHISTICATION

Assessment (low confidence): moderate. The Linux/ESXi encryptor uses modern cryptography without an OpenSSL dependency, supports partial encryption and multithreading, and force-kills virtual machines before encryption. [6] No zero-day use, exploited CVE, or phishing campaign has been publicly attributed. [4]

MALWARE

Linux/ESXi encryptor (SonicWall detection name Orova.RSM). Encrypted files take the .orova extension and carry an OROVAENCRYPTEDL trailer marker. [6] A Windows variant is reported as probable but not confirmed by public sample analysis; the Linux sample includes a -winenv argument for Windows exclusion lists. [4][6]

RANSOM NOTE

000___How_to_Recover_Encrypted_Files___000.txt in the analyzed Linux/ESXi sample. [6] Trackers list message.txt. [3][4] The discrepancy is unresolved and may reflect different variants (unverified).

CONTACT

Tox ID 1F3A17E9670C56A3CCF85581468524FE5997B1131630C67747A11C0B6A131520790DF354547D [3][4][5]

INFRASTRUCTURE

Four Tor services recorded in Intruvent collection. [1] Service labels and a 95.9% average 30-day uptime are as reported by ransomware.live. [3]
LEAK SITE (NGINX 1.18.0): mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion
SIGN-IN / NEGOTIATION (WSGIServer 0.2): ns7y6bxawualjj5rpo5num6syejd7hgaowrndk3r4duxu2iyinzv6hid.onion
NOTICE PORTAL (Apache): maa2yprc5pldyr5hjn246hw7i66wdhglnostqgqkcbuh4vyyeos4xxyd.onion
NOTICE PORTAL (Apache): mzlajyncb2rafn5bsb7esmo73kyawjxeirunba27n6nermmafzlcp4qd.onion

03· TARGETING PROFILE

US small organizations plus an outsized Hong Kong and Taiwan share

Sectors (as tagged)

Other / untagged (14) [1]
Healthcare (6) [1]
Professional Services (5) [1]
Technology (5) [1]
Manufacturing (5) [1]
Agriculture and Food (2) [1]
Energy & Utilities (2) [1]
Financial Services (2) [1]
Hospitality (2) [1]
Retail & E-Commerce (2) [1]
Government (1); Not Found (1) [1]

Countries (as tagged)

United States (25) [1]
Hong Kong (10) [1]
Taiwan (8) [1]
Brazil (1) [1]
Egypt (1) [1]
India (1) [1]
Japan (1) [1]

Victim Profile

Mostly small and mid-size organizations, per listing descriptions (Intruvent assessment) [1]
US healthcare providers (medical, dental, veterinary) and health technology [1]
Taiwan OEM/ODM, electronics, and semiconductor-services firms [1]
Hong Kong asset management, property, hospitality, and textile firms [1]
A cluster of Florida small businesses and community organizations [1]

Hong Kong and Taiwan concentration. Between 04 August and 21 September 2026, Intruvent collection recorded 1,678 leak-site victims across all tracked groups. Fifteen were tagged Hong Kong and 22 Taiwan. Orova posted 18 of those 37 (49%); the next-highest groups posted 5 (The Gentlemen) and 3 (Qilin). [1] Five Hong Kong listings drew press coverage on 06 August, and HKCERT reportedly contacted the affected organizations. [11] Country tags carry some error: one listing tagged Hong Kong uses a South African domain, one describes a Taiwan-based company, and one describes a mainland China company; one listing tagged United States describes a UK company. [1] The concentration holds even allowing for these. Assessment (low confidence): the concentration may reflect a single access source, such as an access broker or affiliate with a regional footprint, but no reviewed source explains it and Intruvent has no evidence for any specific cause.

Florida cluster. At least nine of the 25 US victims are located in Florida: seven listings name Florida locations, and two more name a Florida town. They include trade contractors, professional services, agriculture, healthcare, and community and religious organizations, and eight of the nine were posted in the 05 to 06 August wave. [1] Assessment (low confidence): a concentration of small, co-located organizations in one posting wave is consistent with a shared access source, such as a common IT service provider or access broker. No reviewed source confirms any shared access path.

04· TRADECRAFT & TTPs

Encryptor confirmed by sample analysis; intrusion chain inferred by trackers

One public sample analysis exists (SonicWall, Linux/ESXi). [6] No incident response report or intrusion forensics had been published as of 24 September 2026. Techniques below are grouped by evidence strength. Tracker mappings are labeled "Probable" by their source and are not confirmed by forensic evidence. Proven Data also lists a technique ID (T1685) that Intruvent could not verify against the ATT&CK matrix; it is omitted. [4]

MITRE IDTECHNIQUEOBSERVED USE

SAMPLE ANALYSIS (SONICWALL, LINUX/ESXi)

T1486Data Encrypted for ImpactCurve25519 key agreement with ChaCha20 file encryption and SHA-256; .orova extension; ephemeral public key, OROVAENCRYPTEDL marker, and flags byte appended to each file. Supports partial encryption (--percent=) and worker threads (--threads=). [6]

T1489Service StopWith -killvm, enumerates VMs via esxcli vm process list and force-kills them via esxcli vm process kill --type=force. [6] ATT&CK mapping inferred by Intruvent from the documented behavior.

T1083File and Directory DiscoveryWalks operator-supplied paths (--paths=), optionally only recently modified files (-recent), skipping system directories and extensions. [6] ATT&CK mapping inferred by Intruvent.

TRACKER-ASSESSED (PROBABLE, NOT FORENSICALLY CONFIRMED)

T1078Valid AccountsAssessed probable entry technique; credential-based access correlated with infostealer datasets. [3][4] Infostealer overlap estimates differ: 25.5% of victims (ransomware.live) versus 5 of 46, 10.9% (Breachsense). [3][8]

T1040Network SniffingListed for discovery of hosts, credentials, and reachable services. [3][4]

T1021Remote ServicesLateral movement via RDP and SMB. [3][4]

T1550Use Alternate Authentication MaterialTokens, hashes, or sessions for lateral movement. [4]

T1547Boot or Logon Autostart ExecutionAutostart persistence. [4]

T1071.001Application Layer Protocol: Web ProtocolsExfiltration over standard web protocols before encryption. [3][4]

T1041Exfiltration Over C2 ChannelListed by Mallory.ai. [7] ransomware.live reports 3.1 TB claimed across 37 of 47 victims. [3]

T1537Transfer Data to Cloud AccountListed by Mallory.ai. [7]

T1490Inhibit System RecoveryShadow copy and backup destruction before encryption. [3][4]

T1657Financial TheftExtortion for payment. [7]

TRADECRAFT NOTE

The encryptor behavior above is the only Orova tradecraft confirmed by published technical analysis. The sample had zero VirusTotal detections at the time SonicWall analyzed it. [6] Proven Data reports the group provided decrypted sample files in at least one negotiation, which suggests an operator-side decryptor works; no public decryptor exists. [4] GalaxyWarden describes phishing and exploited remote desktop services as typical initial access but cites no source; this is unverified. [10] No exploited CVE has been publicly linked to Orova. [4]

05· NOTABLE ACTIVITY

47 claimed victims, 35 of them posted in the first three days

All counts are leak-site claims recorded in Intruvent collection. [1] Inclusion does not confirm a breach. Individual victim organizations are not named in this public edition. Micro-sectors are Intruvent groupings based on listing descriptions; country follows the Intruvent collection tag, and "tagged" marks a country tag that conflicts with the listing text (see Section 03).

MICRO-SECTORCOMPOSITION AND COUNTRY BREAKDOWNCOUNT

HealthcareMedical, dental, and veterinary practices and one health-technology vendor. Five US, one Egypt.6

ManufacturingIndustrial equipment, metal fabrication, textiles, molds, consumer electronics, and crafts. Three Hong Kong (tagged), three Taiwan, two US.8

Technology and IT servicesSoftware developers, an IT services provider, electronics design, and semiconductor facility services. Three Taiwan, one US, one Brazil.5

Retail, trading, and distributionConsumer brand retail, sporting-goods trading, office equipment, pharmaceutical distribution, and specialty retail. Two Hong Kong, one Japan, one Taiwan, one US (tagged).5

Construction and building tradesRemodeling, electrical and low-voltage, HVAC, and site development contractors. Four US.4

Professional servicesArchitecture, interior design, site consulting, and accounting. Three US, one Taiwan.4

Community and religious organizationsHomeowner associations and churches. Four US.4

Financial services and insuranceAsset management, an investment holding company, and an insurance agency. Two Hong Kong, one US.3

AgricultureAgricultural supply and equine operations. Two US.2

Real estate and propertyProperty investment and multifamily development. One Hong Kong, one US.2

Hospitality and travelA hotel and a travel company. Two Hong Kong (one tagged).2

GovernmentPublic housing agency. One US.1

Environmental servicesOne India.1

TotalUnited States 25, Hong Kong 10, Taiwan 8, Brazil 1, Egypt 1, India 1, Japan 1.47

Posting waves: 24 postings on 04 August (leak-site launch), 11 on 05 to 06 August, 10 between 11 and 31 August, and 2 on 20 September. [1] Posting dates are not attack dates. Data volume: ransomware.live reports 3.1 TB claimed across 37 of the 47 victims. [3]

Victim counts: Intruvent collection records 47 through 21 September. [1] Other public trackers report 47 (ransomware.live), 46 (Breachsense), 50 (Darkfield), 39 (SonicWall, as of 28 August), and 24 (WatchGuard). [3][8][9][6][5] Tracker counts may share upstream collection and are not independent of one another. Hong Kong press coverage: TechTimes reported five Hong Kong listings on 06 August with estimated attack dates of 27 July to 03 August 2026. [11]

06· DETECTION & HUNT PRIORITIES

Hunt ESXi and credential abuse; indicators are for monitoring only

IOC POSTURE

No IP addresses, domains, or C2 infrastructure have been published for Orova as of 24 September 2026. [4][9] SonicWall published behavior but no sample hash. [6] One MD5 appears on ransomware.live without a stated file identity. [3] Detection must rely on behavior and on the file artifacts documented by SonicWall.

TYPEINDICATORTIER / CONTEXT

INVESTIGATE / MONITOR (NEVER BLOCK AS AN IOC ACTION)

ONIONmll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onionLeak site. Monitor for new postings naming your organization or suppliers. Intruvent collection [1]; public trackers [3][5].

ONIONns7y6bxawualjj5rpo5num6syejd7hgaowrndk3r4duxu2iyinzv6hid.onionNegotiation / sign-in portal. A reference in endpoint or proxy logs warrants incident investigation. Intruvent collection [1]; public trackers [3][5].

ONIONmaa2yprc5pldyr5hjn246hw7i66wdhglnostqgqkcbuh4vyyeos4xxyd.onionNotice portal. Correlation only. Intruvent collection [1]; ransomware.live [3].

ONIONmzlajyncb2rafn5bsb7esmo73kyawjxeirunba27n6nermmafzlcp4qd.onionNotice portal. Correlation only. Intruvent collection [1]; ransomware.live [3].

TOX ID1F3A17E9670C56A3CCF85581468524FE5997B1131630C67747A11C0B6A131520790DF354547DNegotiation contact. Correlate against ransom notes and IR artifacts. [3][4][5]

INVESTIGATE (UNCONFIRMED)

MD5365437a77b3c0f1bad9b3c504ad5102aSingle source; listed as an IoC by ransomware.live with a VirusTotal link, file identity not stated. Not referenced by SonicWall. Verify provenance before any EDR block or alert rule. [3]

FILE ARTIFACTS (DETECTION USE)

EXTENSION.orovaEncrypted file extension, confirmed by sample analysis. [6]

MARKEROROVAENCRYPTEDLTrailer marker in encrypted files. [6]

NOTE000___How_to_Recover_Encrypted_Files___000.txtRansom note, Linux/ESXi sample. [6] Trackers also list message.txt, a generic name with high false-positive potential; use only as context. [3][4]

BLOCKING GUIDANCE

Block (High Confidence): none. No Orova indicator meets the criteria for firewall or Conditional Access blocking. Alert/Monitor (Shared Infrastructure): none published. No IP, ASN, cloud, or CDN indicators exist for this group in reviewed sources. Investigate (Unconfirmed): all indicators above. Onion addresses resolve only inside Tor; adding them to a perimeter blocklist has no protective effect, and a hit in logs is an investigation lead. The Tox ID is a negotiation handle, not a network indicator. The MD5 has undocumented provenance; verify it before deployment. Whether to block Tor egress in general is an organizational policy decision, not an Orova IOC action.

All detection logic below is DETECTION ONLY: behavioral guidance for alerting and analyst triage, untested against Orova intrusions, not for automated blocking.

BEHAVIORDETECTION LOGIC (DETECTION ONLY, UNTESTED)PRIORITY

Forced VM termination on ESXiForward ESXi shell and host logs to the SIEM. Alert on esxcli vm process kill --type=force, especially several kills in a short window or following esxcli vm process list. [6] Legitimate administrators occasionally force-kill hung VMs; triage volume and timing.CRITICAL

Unknown ELF execution on ESXi or Linux serversAlert on execution of unsigned or newly written binaries with arguments such as --paths=, --threads=, --percent=, or -killvm. [6] Also alert on ESXi Shell or SSH being enabled outside change windows.CRITICAL

Mass file renames to .orovaFile-integrity or EDR alert on bursts of files gaining the .orova extension, or creation of 000___How_to_Recover_Encrypted_Files___000.txt across directories. [6] This fires at encryption time; treat as incident declaration, not early warning.HIGH

Anomalous valid-account remote accessAlert on VPN, RDP, or hypervisor-management logins from new locations or devices, and on logins using credentials found in infostealer feeds. Valid accounts is the tracker-assessed probable entry technique. [3][4]HIGH

Backup and recovery sabotageAlert on shadow copy deletion, backup job deletion or disablement, and deletion of VM snapshots. Tracker-assessed technique T1490. [3][4]HIGH

RMM / MSP console abuseMSP clients: alert on scripts or tool deployments pushed from the MSP's RMM platform outside agreed maintenance windows, and on new RMM administrator accounts. Relevant because a shared IT service provider is one possible explanation for the Florida cluster (low-confidence assessment, Section 03).MEDIUM

Large outbound transfers before encryptionAlert on outbound volumes above baseline from file servers, particularly to cloud storage or over web protocols. Trackers report exfiltration precedes encryption. [4][7]MEDIUM

07· DEFENSIVE ACTIONS

Eight actions prioritized against an ESXi-capable extortion group

ACTIONOWNEREFFORT

DO NOW

▢Confirm ESXi and vCenter management interfaces are reachable only from a dedicated management network; disable ESXi Shell and SSH when not in active use; require MFA for vCenter administrationINFRA / VIRTMED

▢Verify immutable or offline copies of VM backups exist and that a VM restore has been tested within the last 90 daysIT / INFRAMED

▢Enforce MFA on all remote access; check corporate domains against infostealer and breach data and force resets on matchesIAM / SOCLOW

THIS QUARTER

▢Forward ESXi host and shell logs to the SIEM and deploy the ESXi detections in Section 06SOC / VIRTMED

▢MSP clients: ask your provider how RMM console access is protected (MFA, IP restrictions, audit logging) and whether script pushes to your estate are logged and reviewableVENDOR RISKLOW

▢Tune DLP and egress monitoring to alert on anomalous outbound volumes from file serversSOC / NETWORKMED

ONGOING

▢Monitor the Orova leak site (via a threat-intel provider) for listings naming your organization, suppliers, or clients; Hong Kong, Taiwan, healthcare, and Florida organizations firstTILOW

▢Healthcare providers: confirm the breach-notification process and privacy notice are current, so a leak-site listing can be answered quicklyCOMPLIANCELOW

08· SOURCES

Bracketed markers in the body point to the numbered sources below. All external sources accessed 24 SEP 2026 unless stated. Three victim-specific press and breach-alert sources cited in the private edition are omitted from this public edition.

Intruvent Technologies (Styx). Orova group record and victim collection. Intruvent collection, pulled 24 September 2026 (newest record 21 September 2026). Group id 2622. Cross-group base rate: 04 August to 21 September 2026, 1,678 victims across all groups in Intruvent collection.
Intruvent Technologies. Golden CTI Database (Codex) queries: actor search, alias resolution, and malware lookup for "Orova". 24 September 2026. No records returned.
Ransomware.live. Orova group page. ransomware.live/group/Orova.
Havryliuk, V. Orova Ransomware: Threat Profile, Leak-Site Analysis, and Incident Response Guidance. Proven Data, 25 August 2026 (statistics updated to 21 September 2026). provendata.com/blog/orova-ransomware.
WatchGuard Technologies. OROVA Ransomware (Ransomware Tracker). watchguard.com/wgrd-security-hub/ransomware-tracker/orova.
SonicWall Capture Labs Threat Research Team. Orova: A New Linux Ransomware Targeting ESXi Hypervisors. 28 August 2026. sonicwall.com/blog/orova-a-new-linux-ransomware-targeting-esxi-hypervisors.
Mallory.ai. Orova actor profile. mallory.ai/actors/019fcd1a-8e13-7728-ac33-153842926387.
Breachsense. OROVA Ransomware: Victims and Activity. breachsense.com/ransomware-groups/orova.
Orizon Darkfield. Orova group page. darkfield.orizon.one/groups/orova.
GalaxyWarden. Breach-listing page on an August 2026 Orova victim. August 2026. URL withheld (names victim); held in Intruvent research files.
McCain, S. Orova Ransomware Breaches Five Hong Kong Firms; SFC's First Cyber Fine Lands Same Day. TechTimes, 06 August 2026. techtimes.com/articles/323271.

VERSION HISTORY

v1.0.1 (24 SEP 2026): Victim names removed; victim listings replaced with sector aggregates per Intruvent public-reporting policy. v1.0 (24 SEP 2026): Initial release. Open items: provenance of the ransomware.live MD5 unverified; Windows variant unconfirmed; ransom note filename discrepancy unresolved; no primary source found for the reported 2025 start date; SOCRadar group page unavailable (HTTP 403).

Download the Orova Threat Profile

INT-TAP-2026-OROVA v1.0, TLP:CLEAR

Download PDF (free)