Overview
Orova is a ransomware leak-site brand that the tracker first lists on 7 July 2026. The tracker maps it to valid accounts, remote services, network sniffing, use of alternate authentication material, and inhibiting system recovery. Its Egyptian entry in our data is a Cairo healthcare firm listed on 4 August 2026.
- First tracked: 2026-07-07
- Discussed in our reports: Egypt
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
Egypt1
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
| Persistence | Discovery | Lateral Movement | Command and Control | Impact | Defense Impairment |
|---|---|---|---|---|---|
| Valid Accounts | Network Sniffing | Remote Services | Web Protocols | Data Encrypted for Impact | Disable or Modify Tools |
| Boot or Logon Autostart Execution | Use Alternate Authentication Material | Inhibit System Recovery |
Technique details
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| OROVA Blog | DLS | mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd[.]onion | Yes |
| Notice | Files | maa2yprc5pldyr5hjn246hw7i66wdhglnostqgqkcbuh4vyyeos4xxyd[.]onion | Yes |
| Sign In | Chat | ns7y6bxawualjj5rpo5num6syejd7hgaowrndk3r4duxu2iyinzv6hid[.]onion | Yes |
| Notice | Files | mzlajyncb2rafn5bsb7esmo73kyawjxeirunba27n6nermmafzlcp4qd[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-17