Ransomware
Orova
2mentions, 7 days
4mentions, 30 days
17victims posted, 30 days
Nov 3, 2026last mentioned
Orova is a ransomware group that has claimed attacks on various targets, including Yost Home Improvements in the USA and multiple companies in Hong Kong, such as SSI HOLDING LIMITED and Sanrio Hong Kong Co., Ltd. The group has also targeted entities like KINGSSON in Taiwan and Conceptual Designs, Inc. in the USA.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
- MARDEC BerhadNov 2, 2026
- Hydrogel Vision CorporationNov 2, 2026
- Harry's InternationalNov 2, 2026
- Raffles United Holdings Pte LtdNov 2, 2026
- Wah Chan Consolidated Sdn BhdOct 23, 2026
- Trevi TechnologyOct 23, 2026
- Bright Property ServiceOct 14, 2026
- Orient CorporationOct 14, 2026
- City ChainOct 13, 2026
- Durga BearingsOct 13, 2026
- Codar (Pte) LtdOct 13, 2026
- Alfameli GroupOct 13, 2026
- Detronics Pte LtdOct 13, 2026
- The Park Lane Hong KongOct 12, 2026
- Libre Wireless TechnologiesOct 12, 2026
- Amantya TechnologiesOct 12, 2026
- Gatetech TechnologyOct 12, 2026
A leak-site post is the group's claim, not confirmed by the victim.
Recent activity
- 饾棞饾棙 饾棙 饾棞饾椈饾棻饾槀饾榾饾榿饾椏饾椂饾棽饾榾 饾棫饾棶饾椏饾棿饾棽饾榿饾棽饾棻 饾棷饾槅 饾棦饾椏饾椉饾槂饾棶: 饾煯饾煷饾煴 饾棜饾棔 饾椉饾棾 饾棗饾棶饾榿饾棶 饾棪饾榿饾椉饾椆饾棽饾椈, 饾棞饾椈饾棸饾椆饾槀饾棻饾椂饾椈饾棿 饾棗饾椉饾棸饾槀饾椇饾棽饾椈饾榿饾榾 饾棩饾棽饾椆饾棶饾榿饾棽饾棻 饾榿饾椉mastodon 路 Nov 3, 2026
- 馃毃New ransom group blog posts!馃毃 Group name: safepay Post title: deom.be Organization: DEOM B.V. Location: 馃嚙馃嚜 BE Sector: Manufacturing Info: https:// cti.fyi/mastodon 路 Nov 2, 2026
- 馃毃New ransom group blog post!馃毃 Group name: Orova Post title: Trevi Technology Location: 馃嚬馃嚰 TW Sector: Technology Info: https:// cti.fyi/#disclosure/Orova/Tremastodon 路 Oct 23, 2026
- 馃毃New ransom group blog post!馃毃 Group name: Orova Post title: Wah Chan Consolidated Sdn Bhd Location: 馃嚥馃嚲 MY Sector: Other Info: https:// cti.fyi/#disclosure/Omastodon 路 Oct 23, 2026
References
- https://socradar.io/free-tools/ransomware-intelligence/groups/orova
- https://www.ransomlook.io/group/orova
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.