Osiris
A ransomware family documented by Symantec's researchers from one attack in Southeast Asia in November 2025. The attackers used a malicious driver to disable security tools and stole data first. Nothing is known about who developed it.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Symantec says nothing is known about who developed Osiris or whether it operates as ransomware-as-a-service. It found no link to the 2016 family of the same name.1
Symantec notes overlaps with Inc ransomware: use of Wasabi for exfiltration and a matching Mimikatz file name. It says this could mean the operators copied Inc's tactics, or that a former Inc affiliate is involved.1
The sources do not establish a UK link.
A single documented attack is thin evidence. The useful lesson is defensive: attackers who can load a malicious signed driver may blind your endpoint tools before encryption starts.
How It Attacks
Based on one attack in November 2025, described by Symantec.1 Treat it as a single case and not a pattern.
- 1
Prepare the Network
Uses dual-use tools such as Netscan, NetExec and MeshAgent, plus a modified remote desktop tool in disguise.
- 2
Take the Credentials
Runs a Mimikatz build.
- 3
Steal First
Copies data to Wasabi cloud storage with Rclone days before deploying the ransomware.
- 4
Blind the Defences
Uses the Poortry driver and KillAV to disable security software.
- 5
Encrypt
Stops services, deletes snapshots, encrypts files and can disable Hyper-V virtual machines.
Key Techniques
Our mapping of the behaviour Symantec describes.1 Osiris has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1219.002 | Remote Desktop Software | Command and Control | Uses MeshAgent and a modified Rustdesk tool. |
| T1036 | Masquerading | Stealth | Disguises tools and a driver as legitimate products. |
| T1003 | OS Credential Dumping | Credential Access | Uses a Mimikatz build. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends data to Wasabi using Rclone. |
| T1685 | Disable or Modify Tools | Defense Impairment | Uses Poortry and KillAV to disable security software. |
| T1489 | Service Stop | Impact | Stops services and processes before encryption. |
| T1490 | Inhibit System Recovery | Impact | Deletes VSS snapshots. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files fully or partially. |
Tools Observed
Remote Access and Discovery
Credentials and Exfiltration
Defence Evasion
From Symantec's single case.1 Symantec says Poortry is not believed to belong to one actor, so its past use by Medusa operators is at most a possible indicator.
Defences That Matter
Defend the Defences
- Enable tamper protection on endpoint tools.
- Use Microsoft's vulnerable driver blocklist and alert on new kernel drivers.
Watch for Hands-On Activity
- Monitor for unapproved remote access tools, renamed file transfer utilities and large outbound transfers.
- Alert on attempts to stop security tools or delete shadow copies.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Would You Notice Your Security Tools Going Quiet?
We can help you test detection for attempts to disable endpoint protection.
Sources
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.