Obsidian ORB Ransomware Demands Gift Cards

This report analyzes the Obsidian ORB ransomware — a .NET-based hybrid RSA/AES family that establishes persistence, encrypts or overwrites files (based on size), propagates to other drives, deletes backups and recovery options, and demands ransom payment via gift cards; the analysis includes sample hashes, targeted file extensions, MITRE ATT&CK mappings, IOCs, and mitigation recommendations.