Osiris Ransomware Emerges with POORTRY Driver

A new player has entered the ransomware game—Osiris, a group that recently attacked a major food franchise in Southeast Asia. This attack uses a cunning approach called “bring your own vulnerable driver” (BYOVD), specifically leveraging the POORTRY driver to disable security defenses, as highlighted by cybersecurity experts from Symantec and Carbon Black.

What’s intriguing about Osiris is its uniqueness. While it shares a name with a 2016 ransomware variant tied to the infamous Locky family, it’s not related. The question of whether it’s being offered as Ransomware as a Service (RaaS) is still up in the air. Initial investigations suggest possible links to the INC ransomware group, also known as Warble.

The attackers used a suite of tactics, including the custom POORTRY driver, to bypass protection mechanisms. They also exfiltrated data using Rclone to Wasabi cloud storage. Employing sophisticated encryption, the ransomware halts services and targets specific directories, leaving victims with a ransom note.

Ransomware Landscape in 2025

Ransomware incidents rose slightly in 2025. Key groups like Akira, Qilin, Play, and LockBit remain active. Akira exploits Throttlestop drivers, while LockBit continues refining its tactics despite law enforcement pressure. Makop targets businesses via exposed RDP, a common entry point.

• Akira: Attacks small businesses during mergers, often utilizing vulnerable drivers.
• LockBit: Keeps enhancing operations and expanding its reach.
• Makop: Increases foothold by exploiting remote desktop services.

Organizations must be vigilant. Monitoring dual-use tools, limiting RDP access, using multi-factor authentication, and enforcing strict application controls are crucial steps in defense. With ransomware evolving and expanding into new threats, staying informed is more important than ever.

For ongoing updates, stay connected with industry news and insights.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.