Orova is a compact Linux encryptor aimed at VMware ESXi hosts and other x86-64 servers, first reported in mid-2026. Affected files keep their names with .orova added on the end, for example a disk image ending in .vmdk.orova, and each folder receives a text note titled 000___How_to_Recover_Encrypted_Files___000.txt, whose zero-padded name pushes it to the top of a directory listing. The note names the strain, gives a three-day deadline, and supplies a Tor payment portal plus a login code issued to the victim. Operators can force-stop every running virtual machine before encryption and can switch exclusion lists to handle Windows shares mounted over NFS or SMB. Per-file keys are derived through Curve25519 and data is scrambled with ChaCha20, leaving a marker string and key material at the end of each file. A separate leak blog lists unpaid organisations across many sectors, with American, Hong Kong and Taiwanese victims the most common, and the note itemises stolen financial, board and personnel records.
File extensions: .orova
Ransom note filenames: 000___How_to_Recover_Encrypted_Files___000.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161