Threat Attribution and Infrastructure
Attribution Context: Activity linked to Osiris began in November 2025 and focused on food service organizations with franchise operations across Southeast Asia. At this stage, it is unclear whether Osiris is offered as a ransomware-as-a-service (RaaS) platform or operated by a closed group.
Tactical Overlap with Inc Ransomware: Several technical details suggest a possible connection to Inc ransomware activity. The attackers used the same data exfiltration method seen in Inc campaigns, specifically uploading stolen data to Wasabi cloud storage buckets that were previously linked to Inc operations in October 2025. In addition, credential theft was performed using Mimikatz with the same filename, kaz.exe, which has been repeatedly observed in Inc-related intrusions. These overlaps point to several possible explanations: Inc affiliates may have moved to a new ransomware strain, a different group may be copying Inc’s techniques, or multiple threat actors may be using shared tools and methods from underground sources.
Ransomware Technical Capabilities
Command-Line Parameters
Osiris supports multiple command-line arguments that control how it runs. The log option defines where execution logs are written. The file and path options allow attackers to encrypt a single file or entire directory structures. The hyperv parameter shuts down Hyper-V virtual machines and deletes their configuration files, while hyperv-skip allows specific virtual machines to be excluded. The mode option controls how much of each file is encrypted, using either “head” mode for partial encryption or “full” mode for complete file encryption.
Encryption Exclusions
Protected File Extensions: To keep systems functional and avoid damaging critical components, Osiris skips files with specific extensions, including .exe, .dll, .msi, .mp4, .mp3, .mov, .m4v, .iso, .avi, .apk, .msu, .tib, .ai, .inf, .sys, .lnk, .url, and .cat.
Protected System Directories: Entire system folders are excluded from encryption, such as windows, perflogs, programdata, documents and settings, system volume information, $recycle.bin, $winreagent, and all users directories.
Partially Excluded Directories: Some directories, including program files, program files (x86), and programdata, are not fully excluded. Osiris selectively encrypts certain files within these locations while leaving enough intact to keep the operating system running.
Process and Service Termination
Terminated Processes: Osiris forcibly stops a wide range of running processes to avoid file locks and maximize encryption coverage. These include database services (such as sql, oracle, ocssd, dbsnmp, synctime, agntsvc, isqlplussvc, xfssvccon, dbeng50, sqbcoreservice), productivity applications (including excel, infopath, msaccess, mspub, onenote, outlook, powerpnt, visio, winword, wordpad, and notepad), communication and synchronization tools (firefox, steam, thebat, thunderbird, onedrive), and various system utilities and update services.
Stopped Services: The ransomware also disables services associated with backups and enterprise applications. These include Volume Shadow Copy (vss), SQL Server services, memory management services, Microsoft Exchange, Veeam and other backup platforms, and multiple backup-related services such as GxVss, GxBlr, GxCVD, and GxCIMgr.
Cryptographic Implementation
Encryption Algorithm: Osiris uses a hybrid encryption model that combines Elliptic Curve Cryptography (ECC) with AES-128 in CTR mode. Each file is encrypted with a unique AES key, limiting the impact of any single key compromise. To improve speed and efficiency, the ransomware uses Completion I/O Ports (IOCP), allowing multiple files to be encrypted in parallel.
File Modification and Recovery Prevention: Once encryption is complete, Osiris appends the .Osiris extension to affected files, changing filenames such as document.txt to document.txt.Osiris. It then deletes Volume Shadow Copies to block system restore and recovery attempts.
Ransom Note: A ransom note named Osiris-MESSAGE.txt is dropped on compromised systems. The note lists the data allegedly stolen by the attackers and provides a link to a chat portal where victims can communicate with the threat actors.
Attack Chain Reconstruction
Initial Access and Reconnaissance Phase
Unusual activity was detected several days before the ransomware was deployed. Attackers first enabled Remote Desktop Protocol (RDP) to establish persistent access. They conducted network discovery using Netscan and relied on Netexec to execute commands and move laterally across systems.
Credential Harvesting Operations
Mimikatz was deployed under the filename kaz.exe to extract credentials from compromised systems. This tool was used to dump plaintext passwords, password hashes, and Kerberos tickets from LSASS memory. The reuse of the kaz.exe filename strongly mirrors previous Inc ransomware campaigns and enabled attackers to expand access and escalate privileges.
Remote Access Tool Deployment
Modified RustDesk Implementation: The attackers installed a customized version of RustDesk, a legitimate remote management tool, that was altered to hide its true purpose. The file description was changed to “WinZip Remote Desktop,” and the application icon was replaced with WinZip branding. These changes helped the tool appear legitimate to users. This provided persistent remote access separate from RDP. MeshAgent was also deployed to establish additional remote management channels, ensuring continued access even if one method was detected and blocked.
Defense Evasion via BYOVD Attack
Poortry Driver Deployment and Context: A malicious driver known as Abyssworker or Poortry was deployed while posing as a Malwarebytes anti-exploit driver. Poortry was first documented by Google’s Mandiant team in 2022 and has since been used by Medusa ransomware operators in 2024 and 2025. It is commonly deployed using a loader called Stonestop.
BYOVD Attack Methodology: Bring Your Own Vulnerable Driver (BYOVD) attacks are one of the most common methods used by ransomware operators to disable security tools. In this approach, a signed driver—either vulnerable or malicious—is loaded into the Windows kernel. Once running with kernel-level privileges, the driver can terminate security processes, disable EDR solutions, and bypass monitoring and application control systems. Because kernel-mode code operates at a higher privilege level than most security software, these actions are difficult to block.
Technical Significance of Poortry: Poortry is notable because it appears to have been custom-developed by attackers and signed with a legitimate code-signing certificate. This differs from typical BYOVD attacks, which usually abuse known vulnerable drivers from legitimate vendors. Obtaining a signed custom driver suggests a higher level of sophistication, potentially involving compromised signing infrastructure or successful social engineering of certificate authorities.
Supporting Tooling: KillAV, a tool designed to load vulnerable drivers and terminate security software, was also used to automate defense evasion across the environment.
Data Exfiltration Operations
Days before encryption, attackers used Rclone to steal sensitive data from the network. The data was uploaded to Wasabi cloud storage buckets. This method is significant because Inc ransomware actors used the same exfiltration destination in October 2025, reinforcing the possibility of shared techniques or operational links.
Final Encryption Stage
After completing data theft, credential harvesting, and security disablement, the Osiris ransomware was deployed across the network. It encrypted data on all reachable systems and storage volumes, effectively disrupting operations and denying access to critical business data.
Threat Actor Assessment
Experience Level and Sophistication
The attack shows the hallmarks of an experienced ransomware group. The attackers staged data exfiltration before encryption, enabling double-extortion pressure. Advanced defense evasion through BYOVD techniques and the coordinated use of multiple tools indicate strong technical expertise and careful planning. The combination of custom-modified tools and legitimate administrative utilities reflects a mature and methodical operation.
Possible Inc Ransomware Connection
The similarities to Inc ransomware activity suggest either direct reuse of tools or deliberate imitation. The strongest indicators are the use of Wasabi for data exfiltration and the identical Mimikatz filename. These elements could indicate a former Inc affiliate launching a new operation, a different group copying Inc tradecraft to obscure attribution, or shared toolkits circulating among multiple ransomware crews.
Medusa Ransomware Overlap
Poortry’s prior association with Medusa ransomware may indicate indirect links within the ransomware ecosystem. However, Poortry is not exclusive to any single group, and its use may simply reflect the growing adoption of effective BYOVD techniques rather than a direct relationship.
Defense Recommendations
Detection Opportunities: Organizations should watch for suspicious driver installations, especially drivers claiming to be security software. Unexpected Rclone activity, unusual cloud data transfers, and Mimikatz-related behavior such as LSASS memory access should be treated as high-risk events. Alerts should also be triggered by unexpected RDP enablement, abnormal service stoppages, and execution of VSS deletion commands outside approved maintenance windows.
Mitigation Strategies: Strong defensive controls should include strict driver signature enforcement, limited RDP exposure with VPN and multi-factor authentication, and credential protection features such as Windows Credential Guard. Offline and immutable backups are critical to recovery. Cloud storage usage should be monitored for unauthorized access, and application allowlisting should restrict remote administration tools to approved software only.
Osiris represents a capable and well-executed ransomware threat operated by skilled attackers. While its long-term impact remains uncertain, the campaign demonstrates a deep understanding of modern ransomware tactics, including data theft, defense evasion, and operational staging. The overlaps with Inc ransomware activity and the use of Poortry highlight potential connections within the broader ransomware ecosystem. Continued monitoring and intelligence collection will be essential to track how Osiris evolves and whether its operators maintain or expand these operational ties.
References
- Symantec by Broadcom Osiris: New Ransomware, Experienced Attackers?
- CyberMate Introducing Osiris: A Sophisticated New Ransomware Threat
- Elastion Locky-Osiris Ransomware
- Microsoft Osiris Ransomware belongs to a batch of variants of the Locky Ransomware