osiris is a ransomware operator currently active on public leak sites. Darkfield has indexed 3 public victims claimed by this operator between December 18, 2025 and March 23, 2026. Osiris is a recently emerged ransomware group first observed in December 2025, operating with apparent financial motivations based on their targeting patterns and limited known victim base of three organizations. The group's origin and affiliations remain unclear due to their recent emergence, though their targeting of victims across the United States, India, and the Philippines suggests either a broad opportunistic approach or potential connections to actors operating across these regions. Limited intelligence is available regarding Osiris's specific attack methodology, encryption techniques, or whether they employ data exfiltration tactics prior to encryption, though their focus on manufacturing and technology sectors indicates they may be targeting organizations with valuable intellectual property or operational data. No major high-profile campaigns or significant ransoms have been publicly documented for this group, likely due to their recent emergence and small victim count. Given the December 2025 first observation date, Osiris appears to be a newly active threat actor, though insufficient data exists to determine their operational tempo, capabilities, or long-term threat potential.

Recent disclosures by osiris

All 3 indexed disclosures. Click any row for the full per-victim dossier.

• Mantra Softech PvtTechnology · India · March 23, 2026
• American VanguardManufacturing · United States · January 9, 2026
• The Araneta GroupNot Found · PH · December 18, 2025

See every disclosure indexed for osiris →