Loading threat actor…
Obscura is a ransomware group and associated ransomware variant that emerged in September 2024 and remained active into 2025 and 2026 as part of the broader proliferation of smaller, short-lived extortion crews. It has publicly claimed victims across multiple sectors and has shown a comparatively strong concentration on the energy and utilities sector relative to many other ransomware groups. Reported victims indicate activity against organizations in manufacturing, healthcare-related services, media, and energy-related environments. Obscura is notable for using ransomware tradecraft associated with modern extortion operations, including file encryption and operation of a victim leak site. Reporting also links the group to Bring Your Own Vulnerable Driver techniques, indicating efforts to impair endpoint defenses through abuse of signed but vulnerable kernel drivers before or during ransomware deployment. This places the group among ransomware actors adopting more advanced defense-evasion methods commonly associated with disabling security tooling. The ransomware itself has been reported to contain a serious implementation flaw: files larger than 1 GB may become permanently unrecoverable because the malware fails to preserve required key material correctly. As a result, payment does not reliably enable recovery for affected large files. This defect distinguishes Obscura from more mature ransomware operations and suggests uneven development quality despite the group’s operational activity. Obscura is best characterized as a financially motivated ransomware actor rather than a state-sponsored intrusion set. No high-confidence attribution to a specific country of origin is currently available from the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation noted here for flawed encryption implementation causing irreversible file loss for large files.
Referenced as a ransomware group observed using BYOVD-style defense evasion (vulnerable driver abuse) to impair endpoint defenses.
Ransomware group showing comparatively high focus on the energy and utilities industry.
Obscura is a small, short-lived ransomware crew, part of the new generation of agile ransomware groups that have emerged as the ecosystem splinters.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.