Signalis
sign in--:--:--UTC
Threat actors

Orova

☆ pin
Reports
36
First seen
Aug 4, 2026
Last seen
Aug 11, 2026
Motivation
Financial

Targeting

Sectors
Other ×8Manufacturing ×5Healthcare ×5Professional Services ×4Retail & E-commerce ×3Financial Services ×2Agriculture ×1Hospitality ×1
Victim regions
×1
×16
United States×16
Hong Kong SAR China×4
Thailand×1
Taiwan×1
Japan×1
Brazil×1
Egypt×1
United Kingdom×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Indicators

domain ×68ip_v4 ×8hash_sha1 ×3hash_md5 ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Orova ransomware gang claims Ganzhou Xinye Craft Co., Ltd.

ransomware.liveHigh

Orova Ransomware Claims First Baptist Church of Belleview

ransomware.liveHigh

Orova ransomware gang claims attack on Hilliard's Air Conditioning & Heating Inc

ransomware.liveMedium

Orova ransomware gang publishes Gemstone UK as victim

ransomware.liveHigh

Orova ransomware publishes St Theresa Catholic Church as victim

ransomware.liveMedium

Orova ransomware claims Stoneybrook West Master Association as victim

ransomware.liveHigh

Orova ransomware gang publishes Stonecrest POA as victim

ransomware.liveHigh

Orova ransomware gang publishes Magnolia Dental as victim

ransomware.liveMedium

Orova ransomware publishes Country Oaks Veterinary Clinic as victim

ransomware.liveHigh

Orova ransomware: David King Architect victim claim

ransomware.liveHigh

Orova ransomware gang publishes Woodside Ranch as victim

ransomware.liveMedium

Orova ransomware gang publishes FixIT Tek as victim

ransomware.liveHigh

Orova claims new victim: ADG Healthcare

ransomware.liveHigh

Orova ransomware gang claims eSysTech breach

ransomware.liveHigh

Orova ransomware claims Northeastern Communications & Electrical as victim

ransomware.liveHigh

Orova ransomware claims Apollo Office System as victim

ransomware.liveHigh

Orova ransomware publishes EMPYREAN INT'L TECHNO DEVICES as victim

ransomware.liveHigh

Orova ransomware claims Texas Medical Screening victim

ransomware.liveHigh

Orova ransomware claims South Carolina Regional Housing Authority

ransomware.liveHigh

Orova claims BJS Insurance & Financial as ransomware victim

ransomware.liveMedium

Orova claims Wisdom Oral Surgery victim

ransomware.liveHigh

Orova ransomware publishes SURE TRAVEL COMPANY as victim

ransomware.liveHigh

Orova ransomware gang publishes SBI Manufacturing as victim

ransomware.liveHigh

Orova claims Agricultural Chemical Solutions victim on ransomware.live

ransomware.liveHigh

Orova ransomware gang publishes DBM Reflex as victim

ransomware.liveHigh

Orova ransomware gang publishes Ultra Fame as victim

ransomware.liveHigh

Orova claims Cardiology Associates of Port Huron breach

ransomware.liveHigh

Orova publishes Yost Home Improvements as ransomware victim

ransomware.liveMedium

Orova ransomware gang publishes KINGSSON as new victim

ransomware.liveHigh

Orova publishes SSI Holding (Far East) Limited as ransomware victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans