{ "id": "e84f0ea1-5028-4ae5-af96-5aea60569617", "created_at": "2026-08-10T02:02:33.354013Z", "updated_at": "2026-08-10T02:03:58.45679Z", "deleted_at": null, "sha1_hash": "0ea0eb678ddf7ac7d6cffa353444fd13e0956122", "title": "orova Ransomware Group Profile | SOCRadar", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 75449, "plain_text": "https://socradar.io/free-tools/ransomware-intelligence/groups/orova\n\norova Ransomware Group Profile | SOCRadar\n\nBy SOCRadar\n\nArchived: 2026-08-10 02:00:17 UTC\n\n1. Ransomware Intelligence\n\n2. Groups\n\n3. orova\n\nDescription\n\nOrova is a newly emerged ransomware extortion group that has been active since mid-2026. They focus on\n\ncompromising corporate networks and leveraging data exfiltration to enforce ransom payments, utilizing a dedicated\n\ndata leak site on the dark web to publish stolen files if demands are not met.\n\nKey insights\n\n•Orova employs a data leak site to pressure victims into paying ransom.\n\n•The group's operations are aligned with modern data-theft extortion tactics.\n\n•They target corporate networks primarily.\n\n•Orova has been active since mid-2026.\n\n•Victims face public exposure of stolen proprietary data.\n\n•Their model includes both data encryption and data exfiltration.\n\nThreat Level \u0026 Status Breakdown\n\nFor orova · Based on incidents in selected period\n\n4.2threat level\n\nAggressiveness10/ 10\n\nPage 1 of 5\n\nhttps://socradar.io/free-tools/ransomware-intelligence/groups/orova\n\nLethality0/ 10\n\nCriticality2.4/ 10\n\nStatus Breakdown\n\nClaimed100.0%35\n\nFirst seenMay 2026\n\nLast seenAug 2026\n\nAvg ransom—\n\nPayment rate—\n\nStatusactive\n\nSophistication0\n\nLast updatedAug 9, 2026\n\nRecent activity\n\nMonthly attack count for orova in the selected period\n\n35Total attacks\n\n16peak in Aug\n\n8.8avg / month\n\n↑ 9 vs first month\n\nNo intelligence data for this group.\n\nTTPs \u0026 Attack Vectors\n\nTools, initial access, and MITRE ATT\u0026CK techniques for orova\n\nDefense Evasion\n\nT1562\n\nImpair Defenses\n\nExecution\n\nT1140\n\nPage 2 of 5\n\nhttps://socradar.io/free-tools/ransomware-intelligence/groups/orova\n\nDeobfuscate/Decode Files or Information\n\nImpact\n\nT1486\n\nData Encrypted for Impact\n\nT1490\n\nInhibit System Recovery\n\nLateral Movement\n\nT1021\n\nRemote Services\n\nOther\n\nT1071.001\n\nT1071.001\n\nT1040\n\nT1040\n\nT1550\n\nT1550\n\nT811\n\nT811\n\nPersistence\n\nT1078\n\nValid Accounts\n\nT1547\n\nBoot or Logon Autostart Execution\n\nVictims(35)\n\nPage 3 of 5\n\nhttps://socradar.io/free-tools/ransomware-intelligence/groups/orova\n\nCompany Domain\n\nStoneybrook\nstoneybrookwest.sites.townsq.io\nWest\n\nmystcc mystcc.org\n\nStonecrest\nstonecrestpoa.com\nPOA\n\nCountry Oaks\n\nVeterinary vetstopets.com\n\nClinic\n\nHilliard's Air\n\nConditioning hilliardsairandheat.com\n\n\u0026 Heating Inc\n\nMagnolia\nmagnoliadentalclinic.com\nDental Clinic\n\nFirst Baptist\n\nChurch of fbcbelleview.org\n\nBelleview\n\nGemstone UK gemstoneuk.com\n\nWoodside\nricewoodside.com\nRanch\n\nMapQuest mapquest.com\n\nFixIT Tek fixittek.com\n\nJK Capital\n\nManagement jkcapitalmanagement.com\n\nLimited\n\nGlobal\n\nFriction globalfrictionproducts.com\n\nProducts, Inc.\n\nCountry Industry\n\nUnited\nOther\nStates\n\nUnited\nOther\nStates\n\nUnited\nOther\nStates\n\nUnited\nHealthcare\nStates\n\nUnited Professional\n\nStates Services\n\nUnited\nHealthcare\nStates\n\nUnited\nOther\nStates\n\nUnited\nOther\nStates\n\nUnited\nOther\nStates\n\nUnited Professional\n\nStates Services\n\nUnited\nTechnology\nStates\n\nHong Financial\n\nKong Services\n\nUnited\nManufacturing\nStates\n\nPage 4 of 5\n\nStatus Discovered\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 4 days ago\n\nClaimed 5 days ago\n\nClaimed 6 days ago\n\nClaimed 6 days ago\n\nhttps://socradar.io/free-tools/ransomware-intelligence/groups/orova\n\nCompany Domain\n\nConceptual\nconceptualdesignsinc.com\nDesigns, Inc.\n\nIntegrated\n\nSite ism-sc.com\n\nManagement\n\nTat Fung\n\nTextile Co. tatfung-tex.com\n\nLtd.\n\nSanrio Hong\nsanrio.com.hk\nKong Co., Ltd\n\nS.S.I. Holding\n\n(Far East)\n\nLimited\n\nKINGSSON\n\nCo., Ltd.\n\nYost Home\n\nImprovements\n\nPage 1 of 2\n\nAffected countries(7)\n\nCountries where this group has been reported to target or leak victims.\n\nSource: https://socradar.io/free-tools/ransomware-intelligence/groups/orova\n\nssife.com\n\nkingsson.com.tw\n\nyosthomeimprovements.com\n\nCountry Industry\n\nUnited\nOther\nStates\n\nUnited Professional\n\nStates Services\n\nHong\nManufacturing\nKong\n\nHong Retail \u0026 E-\n\nKong Commerce\n\nHong\nOther\nKong\n\nTaiwan Other\n\nUnited Retail \u0026 E-\n\nStates Commerce\n\nPage 5 of 5\n\nStatus Discovered\n\nClaimed 6 days ago\n\nClaimed 6 days ago\n\nClaimed 6 days ago\n\nClaimed 6 days ago\n\nClaimed 6 days ago\n\nClaimed 6 days ago\n\nClaimed 6 days ago", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY" ], "origins": [ "web" ], "references": [ "https://socradar.io/free-tools/ransomware-intelligence/groups/orova" ], "report_names": [ "orova" ], "threat_actors": [], "ts_created_at": 1786327353, "ts_updated_at": 1786327438, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0ea0eb678ddf7ac7d6cffa353444fd13e0956122.pdf", "text": "https://archive.orkl.eu/0ea0eb678ddf7ac7d6cffa353444fd13e0956122.txt", "img": "https://archive.orkl.eu/0ea0eb678ddf7ac7d6cffa353444fd13e0956122.jpg" } }