Full Report
Poortry driver and modified Rustdesk tool used in recent attack campaign, which bears similarities to previous Inc ransomware attacks.
Analysis Summary
# Threat Actor: Unknown Actor(s) associated with Osiris Ransomware (Potential Inc. Link)
## Attribution & Identity
The specific threat actor group behind the Osiris ransomware is currently unknown, and there is no indication of a link to the older 2016 Osiris ransomware variant (Locky descendant). However, overlaps in tactics, tools, and filenames with previous **Inc ransomware** attacks suggest potential connections, such as emulation of tactics or the involvement of a former Inc affiliate.
## Activity Summary
The activity detailed revolves around a recent attack campaign utilizing the novel **Osiris ransomware** against a major food service franchisee operator in **Southeast Asia** in **November 2025**. The campaign involved pre-ransomware data exfiltration followed by deployment of the ransomware.
## Tactics, Techniques & Procedures
- **Bring-Your-Own-Vulnerable-Driver (BYOVD):** Deployment of a malicious driver (Poortry/Abyssworker) disguised as a Malwarebytes anti-exploit driver to disable security software.
- **Evasion/Masquerading:** Modification of the Rustdesk RMM tool to disguise its functionality, using the file description "WinZip Remote Desktop" and the WinZip icon.
- **Credential Access:** Use of a specific version of Mimikatz, utilizing the filename `kaz.exe`, which was previously observed in Inc ransomware attacks.
- **Data Exfiltration:** Use of Rclone to exfiltrate data to Wasabi cloud storage buckets (a tactic previously seen in Inc operations).
- **System Disruption:** Encryption followed by VSS deletion to prevent recovery.
- **Process/Service Termination:** Termination of numerous critical processes (e.g., database services, security clients, MS Office applications) and services (e.g., VSS, backup services).
- **Ransomware Execution:** Utilizes hybrid encryption (ECC + AES-128-CTR) with a unique AES key per file.
## Targeting
- **Sectors:** Food Service Franchisee Operator.
- **Geography:** Southeast Asia.
- **Victims:** A major food service franchisee operator (specific name withheld).
## Tools & Infrastructure
- **Ransomware:** Osiris (New family, hybrid encryption scheme).
- **Malware/Exploits:** Poortry/Abyssworker driver (for BYOVD).
- **Dual-Use/Legitimate Tools:** Rclone, Netscan, Netexec, MeshAgent.
- **Modified Tools:** Custom version of Rustdesk RMM (masquerading as WinZip Remote Desktop).
- **Credential Access Tool:** Mimikatz (using filename `kaz.exe`).
- **Network Indicator(s):** `ausare[.]net`, `wesir[.]net` (Likely C2 or related infrastructure, defanged).
- **Exfiltration Destination:** Wasabi buckets.
## Implications
The emergence of Osiris, while novel, carries the significant implication of potential linkage to the experienced Inc ransomware operators or affiliates. The combination of advanced evasion (BYOVD with Poortry) and the reuse of specific, non-public indicators (Mimikatz filename `kaz.exe`) suggests a sophisticated, persistent threat actor focused on double extortion (encryption and data theft).
## Mitigations
- **Driver Monitoring:** Implement strict policies or driver signature enforcement to prevent the loading of unsigned or untrusted drivers, specifically monitoring for known patterns associated with Poortry/Abyssworker (BYOVD defense).
- **Endpoint Detection & Response (EDR):** Focus on detecting the execution of known offensive tools (Rclone, Netexec, MeshAgent) and the behavior of credential dumping tools like Mimikatz, regardless of filename.
- **RMM Monitoring:** Implement application allow-listing or strict behavioral monitoring for remote access tools, specifically looking for unusual modifications or masquerading (like Rustdesk presenting as "WinZip Remote Desktop").
- **Lateral Movement & Exfiltration Controls:** Monitor outbound traffic to cloud storage providers (like Wasabi) for large data transfers, especially when originating from unexpected binaries or processes.
- **Incident Response Preparedness:** Review response protocols specifically targeting ransomware incidents that involve evidence of pre-encryption data theft.