Quick Summary
A new ransomware strain named Osiris has emerged, targeting a major food service franchisee operator in Southeast Asia in November 2025. The attack utilized a malicious driver called POORTRY as part of a bring your own vulnerable driver (BYOVD) technique to disable security software. Osiris is assessed as a new ransomware variant, distinct from previous strains, and is linked to threat actors previously associated with INC ransomware.
The Securityish Brief
Cybersecurity researchers have identified a new ransomware family called Osiris, which targeted a significant food service franchisee operator in Southeast Asia in November 2025. The attack employed a malicious driver known as POORTRY, utilizing a bring your own vulnerable driver (BYOVD) technique to disable security software, as reported by the Symantec and Carbon Black Threat Hunter Team.
Osiris is recognized as a brand-new ransomware strain, with no similarities to a previous variant of the same name that emerged in December 2016. The developers of this new ransomware are currently unknown, and it is unclear whether it is being marketed as ransomware-as-a-service (RaaS). The attack involved the exfiltration of sensitive data to Wasabi cloud storage buckets and the use of dual-use tools, including Netscan and a custom version of Rustdesk remote desktop software.
The ransomware employs an effective encryption payload, utilizing a hybrid encryption scheme and unique encryption keys for each file. It is designed to terminate various processes and services related to Microsoft Office, Mozilla Firefox, and other applications, thereby maximizing its impact on the target’s operations.
Notably, the attack’s initial signs included the exfiltration of sensitive data using Rclone before the ransomware was deployed. The presence of tools like KillAV, which is used to deploy vulnerable drivers, and the enabling of RDP for remote access further indicate the sophistication of the attackers.
Current Ransomware Landscape
The emergence of Osiris highlights ongoing trends in the ransomware landscape, where new groups arise as others diminish. In 2025, ransomware actors claimed a total of 4,737 attacks, a slight increase from the previous year. Prominent players included Akira, Qilin, and LockBit, each employing various tactics to breach systems.
For instance, Akira ransomware campaigns have exploited vulnerable drivers and SSL VPNs to gain access to small- to medium-sized business environments. LockBit has continued to evolve, releasing variants that target multiple operating systems and introducing a two-stage ransomware deployment model.
- Osiris: A new ransomware strain targeting a food service franchisee in Southeast Asia.
- POORTRY: A malicious driver used in the BYOVD attack to disable security software.
- KillAV: A tool utilized to deploy vulnerable drivers for terminating security processes.
- Rclone: A tool used for exfiltrating sensitive data to Wasabi cloud storage.
- Akira: A prominent ransomware group exploiting vulnerabilities in various systems.
Key Takeaways
- Monitor for unusual data exfiltration activities, especially to cloud storage services like Wasabi.
- Restrict access to RDP services to prevent unauthorized remote access.
- Implement multi-factor authentication (2FA) to enhance account security.
- Regularly update and patch software to mitigate vulnerabilities that ransomware may exploit.
- Consider using application allowlisting to control which applications can run on your systems.
Key Terms & Concepts
- Osiris: In this article, Osiris refers to a new ransomware strain that targets organizations by encrypting files.
- BYOVD: Bring Your Own Vulnerable Driver (BYOVD) is a technique that exploits vulnerable drivers to disable security software.
- Rclone: Rclone is a command-line program used to manage files on cloud storage, including data exfiltration.
- KillAV: KillAV is a tool used to deploy vulnerable drivers that can terminate security processes on a target network.
- RDP: Remote Desktop Protocol (RDP) is a protocol that allows remote access to computers over a network.
Read the original article here: https://thehackernews.com/2026/01/new-osiris-ransomware-emerges-as-new.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
