Orova — Ransomware Profile
Orova is an extortion operation that WatchGuard classifies as a data broker and records as first seen in May 2026. WatchGuard lists 24 known victims and reports that the group runs direct extortion, double extortion and free data leaks. Victim negotiation runs through a Tor-hosted portal separate from the leak site, and the group publishes a Tox identifier as an alternative contact channel.IntelFusions coverage (2)
- Malaysia draws six different extortion crews in one week 2026-10-29 · Cyber Incidents
- Malaysia's water asset firm lands on Qilin's leak site 2026-10-19 · Cyber Incidents
Recent claimed victims
- MARDEC Berhad 2026-11-03
- Raffles United Holdings Pte Ltd 2026-11-03
- Detronics Pte Ltd 2026-11-03
- Orient Corporation 2026-11-03
- Hydrogel Vision Corporation 2026-11-03
- Bright Property Service 2026-11-03
- Harry's International 2026-11-02
- Wah Chan Consolidated Sdn Bhd 2026-10-23
- Trevi Technology 2026-10-23
- Durga Bearings 2026-10-13
- Alfameli Group 2026-10-13
- Codar (Pte) Ltd 2026-10-13
- The Park Lane Hong Kong 2026-10-12
- Gatetech Technology 2026-10-12
- Libre Wireless Technologies 2026-10-12
- Amantya Technologies 2026-10-12
- Siddhi Green Excellence Pvt. Ltd 2026-09-20
- Euramex Management Group 2026-09-20
- ASYS Corporation 2026-08-31
- Fu Sheng Industrial Co., Ltd 2026-08-31
- ITC Properties Group Limited 2026-08-29
- South Pacific Hotel Limited 2026-08-29
- Bai-chi CPA Firm 2026-08-25
- Arich Enterprise Co., Ltd. 2026-08-25
- Central Florida Civil LLC 2026-08-25
Vendor research
- OROVA Ransomware WatchGuard Technologies