New Osiris Ransomware Leverages Living Off the Land and Dual-Use Tools in Attacks
A newly identified ransomware family, Osiris, targeted a significant foodservice franchisee in Southeast Asia in November 2025. Despite sharing a name with a 2016 Locky ransomware variant, this is an entirely new threat. Evidence suggests potential links…
A newly identified ransomware family, Osiris, targeted a significant foodservice franchisee in Southeast Asia in November 2025. Despite sharing a name with a 2016 Locky ransomware variant, this is an entirely new threat. Evidence suggests potential links to threat actors previously associated with Inc ransomware operations.
The attackers utilized extensive living-off-the-land binaries (LOLBins) and dual-use tools. They leveraged the malicious Poortry driver in a bring-your-own-vulnerable-driver (BYOVD) attack to disable security software on compromised systems. The Symantec and Carbon Black Threat Hunter Team investigation revealed Osiris as a unique ransomware family with unknown developers and unclear operational structure. Tactical overlaps with the Inc ransomware operations were identified, including exfiltration of stolen data to Wasabi cloud storage buckets and the use of Mimikatz with a filename identical to previous Inc ransomware operations.
Osiris exhibits standard ransomware features including service termination, selective folder and file extension encryption, process termination, and ransom note deployment. It accepts multiple command-line parameters for customized operations such as specifying log files, targeting file and directory paths for encryption, disabling Hyper-V VMs, and selecting encryption modes (partial or complete). The ransomware excludes specific file types from encryption and appends the Osiris extension to affected files, deleting system snapshots using Volume Shadow Copy Service (VSS).
Osiris terminates processes of database and productivity applications, communication tools, and system services. It employs a hybrid encryption scheme combining Elliptic Curve Cryptography (ECC) with AES-128-CTR, with each file receiving a unique AES key. Critical services like VSS, SQL services, Microsoft Exchange, and backup solutions are stopped. A ransom note titled "Osiris-MESSAGE.txt" is provided to victims.
A newly identified ransomware family, Osiris, targeted a significant foodservice franchisee in Southeast Asia in November 2025.
Initial suspicious activity was noted several days before ransomware deployment, with data exfiltration using Rclone to Wasabi cloud storage. Attackers deployed multiple dual-use tools including Netscan for network reconnaissance, Netexec for lateral movement, and MeshAgent for remote access. A customized Rustdesk remote monitoring tool was used to evade detection, disguised as "WinZip Remote Desktop."
The attackers used the Abyssworker/Poortry malicious driver, disguised as a Malwarebytes anti-exploit driver, to execute a BYOVD attack. This technique is prevalent among ransomware operators for defense impairment, utilizing signed vulnerable drivers for privilege escalation and process disruption. Poortry was specifically developed for malicious purposes and obtained legitimate code signing. The attackers also deployed KillAV and enabled Remote Desktop Protocol (RDP) for persistent access.
The full impact of Osiris on the threat landscape remains uncertain, but it demonstrates effective encryption capabilities. Tactical overlaps with Inc ransomware operations indicate potential connections to that group or its affiliates.
Based on reporting by GBHackers.