orova Ransomware Group

Key insights

• •Orova employs a data leak site to pressure victims into paying ransom.
• •The group's operations are aligned with modern data-theft extortion tactics.
• •They target corporate networks primarily.
• •Orova has been active since mid-2026.
• •Victims face public exposure of stolen proprietary data.
• •Their model includes both data encryption and data exfiltration.