New Osiris Ransomware Emerges as New Strain Using POORTRY Driver in BYOVD Attack

Cybersecurity researchers have disclosed details of a new ransomware family called Osiris that targeted a major food service franchisee operator in Southeast Asia in November 2025. The attack leveraged a malicious driver called POORTRY as part of a bring your own vulnerable driver (BYOVD) technique to disarm security software.

By the symmetry of the report, Osiris is considered a brand-new strain with no evident ties to other variants bearing the same name, and its developers remain unknown or unconfirmed as a ransomware‑as‑a‑service (RaaS). Exfiltration of data to Wasabi buckets and the use of a version of Mimikatz—the kaz.exe file—previously associated with the INC ransomware point to potential links to INC‑related operations, according to Symantec and Carbon Black Threat Hunter Team.

The payload is described as an “effective encryption payload” that uses a hybrid encryption scheme with a unique key per file, and it can stop services, encrypt specific folders and extensions, terminate processes, and drop a ransom note. First malicious activity involved exfiltrating sensitive data via Rclone before the ransomware deployment, and POORTRY is noted for elevating privileges and terminating security tools rather than relying on a vulnerable driver.