Dark Web Profile: Orion Ransomware

Socradar • January 16, 2026

Share: View original

Orion Ransomware is a newly observed operation identified after the detection of a previously unknown ransomware Data Leak Site (DLS) by SOCRadar.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Emergence of Multiple Ransomware Groups in 2024-2026 Anubis, Orion, and Sarcoma ransomware groups have been identified as significant threats in the cybersecurity landscape. Anubis operates as a Ransomware-as-a-Service (RaaS), while Orion was detected through a new Data Leak Site. Sarcoma, which emerged in late 2024, has been conducting aggressive double-extortion campaigns globally. 4 sources 31

Extracted Entities

Attack Types (1)

Ransomware Groups (1)

Orion Ransomware