Threat Intelligence Report December 16 - December 22 2025

Osiris Ransomware

Osiris is a newly emerged ransomware-as-a-service (RaaS) operation first observed in November 2025. Despite its recent appearance, the group has positioned itself as a sophisticated data broker employing double extortion tactics against high-value corporate targets. The operation shares its name with two unrelated historical threats, the defunct 2016-2017 Locky-Osiris ransomware variant and the Osiris banking trojan but represents an entirely distinct threat actor with modern capabilities.

Osiris operates a TOR-hidden leak site accessible at osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3 bmvfid[.]onion where the group lists victims and threatens data publication. The leak site features a minimalist design with countdown timers and victim profiles, following established ransomware data broker patterns. As of December 2025, the WatchGuard ransomware tracker lists this operation with an "under construction" status, indicating limited technical intelligence availability.

The Red Piranha Team conducts ongoing surveillance of the dark web and other channels to identify global organisations impacted by ransomware attacks. 06 Dec 25 - 12 Dec 25 our monitoring revealed multiple ransomware incidents across diverse threat groups, underscoring the persistent and widespread nature of these cyber risks. This report provides a detailed analysis of Osiris, an emerging data extortion group that has rapidly expanded operations targeting healthcare, government, and critical infrastructure sectors.

Detailed Tactics, Techniques, and Procedures (TTPs)

Initial Access

Osiris likely employs multiple initial access vectors common to modern ransomware operations. Based on victim profiles and RaaS operational patterns, probable attack vectors include:

• Valid Accounts & Credential Abuse (T1078) -- Purchasing stolen credentials from infostealer logs or dark web markets; targeting accounts with VPN/RDP access
• External Remote Services (T1133) -- Exploiting exposed RDP, VPN, or remote management interfaces with weak authentication
• Exploit Public-Facing Application (T1190) -- Targeting unpatched web applications, content management systems, or internet-facing services
• Phishing: Spearphishing Attachment (T1566.001) -- Delivering malicious attachments or links via targeted email campaigns

Execution & Persistence

Following successful initial access, Osiris operators likely deploy payload delivery mechanisms and establish persistence for sustained network access:

• Command and Scripting Interpreter (T1059) -- PowerShell, CMD, or bash scripts for execution and lateral movement
• Create or Modify System Process (T1543) -- Installing malicious services or scheduled tasks for persistence
• Boot or Logon AutoStart Execution (T1547) -- Registry Run keys or startup folder modifications

Defence Evasion

• Impair Defences (T1562) -- Disabling antivirus, EDR agents, or Windows Defender
• Indicator Removal (T1070) -- Clearing event logs, deleting shadow copies, removing forensic artifacts
• Obfuscated Files or Information (T1027) -- Encrypted payloads, packed executables, or code obfuscation

Discovery & Credential Access

• Account Discovery (T1087) -- Enumerating domain accounts, local administrators, privileged users
• System Information Discovery (T1082) -- Identifying OS version, installed software, domain membership
• Network Share Discovery (T1135) -- Mapping accessible file shares for data exfiltration targets
• OS Credential Dumping (T1003) -- LSASS dumping, SAM database extraction, credential harvesting
  
  

Lateral Movement

• Remote Services: SMB/Windows Admin Shares (T1021.002) -- Using administrative credentials to access network systems
• Remote Services: RDP (T1021.001) -- Remote desktop access to spread across network
  
  

Collection & Exfiltration

• Data from Local System (T1005) -- Collecting sensitive files from compromised endpoints
• Data from Network Shared Drive (T1039) -- Accessing file servers, SharePoint, or cloud storage
• Archive Collected Data (T1560) -- Compressing stolen data for efficient exfiltration
• Exfiltration Over Web Service (T1567) -- Uploading to attacker-controlled cloud storage or file-sharing services
  
  

Command-and-Control

• Application Layer Protocol (T1071) -- HTTPS-based C2 communication for stealth
• Encrypted Channel (T1573) -- TOR network usage for anonymity and operational security
  
  

Impact

• Data Encrypted for Impact (T1486) -- Deploying encryption payload across network systems (algorithm unknown)
• Inhibit System Recovery (T1490) -- Deleting Volume Shadow Copies, disabling Windows Recovery, removing backup access

Indicators of Compromise (IOCs)

Network Indicators

• TOR Leak Site:

https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/

http://ausare.net

https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/app/publications

https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/rest/blog/posts?offset=0&limit=10&search=

MITRE ATT&CK Framework Mapping

Mitigation and Detection with Crystal Eye 6.0

1. Access Control & Credential Protection

• Implement multi-factor authentication (MFA) on all remote access services (VPN, RDP, webmail, cloud applications)
• Disable or restrict RDP access; use VPN with MFA for remote management
• Rotate administrative credentials regularly; disable unused accounts
• Monitor dark web for compromised credentials; subscribe to breach notification services
  
  

2. Vulnerability Management

• Patch public-facing applications immediately (web servers, VPNs, email gateways)
• Conduct regular Vulnerability Assessments and Penetration Testing
• Implement web application firewalls (WAF) for internet-facing services
  
  

3. Backup & Recovery Protection

• Maintain offline, immutable backups with air-gapped storage
• Test backup restoration procedures monthly
• Restrict backup system access; monitor for shadow copy deletion attempts
  
  

4. Endpoint Detection & Response (EDR)

• Deploy EDR solutions with behavioural detection capabilities
• Enable tamper protection on security agents
• Monitor for suspicious PowerShell, WMI, or service execution
  
  

5. Network Segmentation & Monitoring

• Segment critical systems (domain controllers, backup servers, databases) from general network
• Block TOR exit nodes at perimeter firewalls
• Monitor for large outbound data transfers and unusual network traffic patterns
  
  

6. Data Loss Prevention (DLP)

• Implement DLP policies for sensitive data (PII, financial records, intellectual property)
• Alert on bulk data downloads or transfers to external services

Ransomware Victims Worldwide

The United States remained the clear epicentre of ransomware activity, accounting for 52.9% of all identified victims this week. That level of concentration means more than half of all known cases were U.S.-based, reinforcing its position as the primary hunting ground for most major ransomware operations.

A strong second tier consisted of the United Kingdom (7.72%), Canada (6.56%), and Germany (4.63%). Together with the U.S., this core group of mature economies represents the bulk of visible global activity, reflecting large digital footprints, higher reporting/disclosure rates, and significant financial upside for threat actors.

A broader mid band followed, including India (2.32%), Australia, Argentina, and Italy (each 1.93%), as well as Spain, Singapore, and France (each 1.54%), plus Malaysia, Chile, Turkey, Sweden (each 1.16%). These countries show that ransomware remains deeply embedded across both established and emerging markets, especially where services, manufacturing, and IT-heavy businesses are concentrated.

Below that, a long tail of countries, Brazil, Taiwan, Croatia, Philippines (each 0.77%), and a wide spread of single-incident geographies such as Mexico, Paraguay, New Zealand, South Korea, Greece, Japan, Venezuela, Belgium, Poland, Bolivia, Dominican Republic, South Africa, Indonesia, Colombia, Slovakia, Portugal, Denmark, China, Estonia (each 0.39%), appeared at low but non-zero volumes. Individually small, their combined footprint underscores that ransomware remains a global problem, with opportunistic and campaign-driven attacks touching almost every region rather than being confined to a handful of high-profile countries.