Site icon TheCyberThrone

Osiris Ransomware Dissection

PravinKarthik
Advertisements

Executive Summary

A newly identified ransomware strain called Osiris surfaced in late-2025 attacks, demonstrating a mature and operator-driven intrusion chain that includes data exfiltration, endpoint defense neutralization using vulnerable driver techniques (BYOVD), credential dumping, and targeted encryption.

Importantly, this Osiris threat is not related to the 2016–2017-era Osiris name used for a Locky ransomware variant. Researchers explicitly highlight that this is a new ransomware family, with experienced operators and tradecraft consistent with modern human-operated ransomware campaigns.

1) What Makes Osiris Different: “New Ransomware, Experienced Attackers”

The Symantec and Carbon Black Threat Hunter Team analysis characterizes Osiris as newly emerged, but not “immature.” The campaign exhibits:

These are all indicators of an actor that already understands enterprise networks and ransomware economics.

Additionally, the report notes overlap in tactics with earlier INC ransomware activity, which raises the probability that Osiris is being operated by seasoned affiliates rather than “newcomers.”

2) Attack Chain Breakdown

Phase 1 — Data Exfiltration First (Wasabi via Rclone)

Before encryption is deployed, Osiris operators prioritize data theft, using Rclone to exfiltrate content to Wasabi cloud storage. This is operationally important because it confirms the intrusion is designed for double extortion (encrypt + leak pressure).

Defender’s takeaway:
If you detect suspicious Rclone activity, you may be in the critical early window before destructive impact begins.

Phase 2 — Recon + Post-Exploitation Tooling

Following exfiltration, the operators deploy internal reconnaissance and movement tooling, including:

This set strongly signals hands-on intruder activity rather than automated malware behavior.

Phase 3 — RDP Enablement + Remote Access Abuse

The campaign enables and uses RDP access as part of the operational pathway—both for movement and for staging ransomware execution.

This matches a pattern defenders repeatedly see: attackers prefer stable interactive access before launching high-risk encryption actions.

Phase 4 — Defense Evasion (KillAV + BYOVD using POORTRY)

One of the most notable technical differentiators in this campaign is the use of KillAV, paired with the POORTRY driver, to disable endpoint security controls.

This is described as a Bring Your Own Vulnerable Driver (BYOVD)-style attack chain used specifically to terminate / neutralize security tooling prior to encryption.

Why it matters:
Once kernel driver abuse enters the chain, defenders can lose visibility at the exact moment they need it most.

Phase 5 — Credential Theft (kaz.exe / Mimikatz variant)

The operators also drop a Mimikatz variant named:

This aligns with hands-on ransomware playbooks: gain credentials → expand access → maximize encryption scope.

Phase 6 — Encryption Deployment & Command-Line Controlled Execution

Encryption is not “spray-and-pray.” It’s executed with operator-selectable options, including:

This indicates the ransomware was engineered and/or configured to optimize both:

3) Encryption & Evasion: Technical Characteristics

Hybrid crypto: ECC + AES-128-CTR

Osiris uses:

This matters in DFIR because it indicates:

File/Folder targeting logic (defensive resilience)

Osiris explicitly skips critical system folders such as:

This is often done to preserve OS stability and ensure the victim can still:

Recovery denial: VSS deletion + service/backup disruption

Osiris implements multiple actions to reduce recovery options:

This is deliberate business disruption engineering.

4) Key Indicators of Compromise (IoCs)

File hashes (SHA-256)

Reported artifacts include:

File and tooling indicators

Network indicators

5) Real-World Impact: November 2025 Southeast Asia Case

According to the published research coverage, Osiris was linked to an attack in November 2025 targeting a major Southeast Asian food service franchise operator, with supporting reporting noting attacker infrastructure/links across multiple regions and RDP-related exploitation patterns.

Victims are pressured through leak-site countdown mechanics—reinforcing the assumption that the intrusion is structured for double extortion outcomes, not just encryption.

6) What Defenders Should Do Now (Actionable Mitigations)

A. Hunt immediately for pre-encryption signals

  1. Rclone execution
  2. unusual connections to Wasabi/S3-like endpoints
  3. spikes in outbound data volume

B. Detect remote access staging

C. Prepare specifically for BYOVD-style EDR killing

D. Protect Hyper-V / virtualization control plane

Because Osiris includes Hyper-V disabling behavior, defenders should:

Conclusion

Osiris (late 2025–2026) is a strong example of the next wave of ransomware execution: data theft first, EDR disruption using BYOVD chains, credential access, then carefully controlled encryption.

The research makes one message clear:

Osiris may be new in name, but not new in capability.

Any organization seeing Wasabi-bound Rclone exfiltration, POORTRY/KillAV artifacts, RustDesk masquerading, or a sudden shift in RDP posture should treat it as a high-confidence ransomware staging event — and respond accordingly.

Exit mobile version