Bright Property Service

This record is a provider-reported ransomware claim attributed to Orova. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector: Construction
Group-published claim date: 2026-10-14T00:00:00.000Z
First tracked: 2026-10-14T05:09:09.396Z
Last observed: 2026-10-14T09:33:04.212Z
Monitoring providers: 4
Independent monitoring providers: 4
Post URL: https://cti.fyi/
Data source: unified
Duplicate records merged: 4

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-10-14T09:33:04.212Z; source-published 2026-10-14T09:33:04.212Z; retrieved 2026-10-14T07:41:52.901Z.
Monitoring provider: observed 2026-10-14T09:33:04.212Z; source-published 2026-10-14T09:33:04.212Z; retrieved 2026-10-14T16:41:56.195Z.
Monitoring provider: observed 2026-10-14T07:45:31.146Z; source-published 2026-10-14T07:45:31.146Z; retrieved 2026-10-14T07:41:52.901Z.
Monitoring provider: observed 2026-10-14T05:09:09.396Z; source-published 2026-10-14T00:00:00.000Z; retrieved 2026-10-22T12:19:46.633Z.
Monitoring provider: observed 2026-10-14T05:09:09.396Z; source-published 2026-10-14T04:54:04.000Z; retrieved 2026-10-15T00:26:58.712Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:0056bcb69b7b3f060843f0b7670d05d802f222f1eb14a670951f0d73b636309d
MISP event UUID
5d23bbbc-b9fe-5eb3-b400-b869fa3c696b
Observed
2026-10-14T09:33:04.212Z
Source-published
2026-10-14T09:33:04.212Z
Retrieved
2026-10-14T07:41:52.901Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
Darkfield by Orizon
Provider URL
https://darkfield.orizon.one/victims/0d3f1741-58c6-434a-a558-90aa07908d0e
Feed id
darkfield
Provider record id
0d3f1741-58c6-434a-a558-90aa07908d0e
Observed
2026-10-14T09:33:04.212Z
Source-published
2026-10-14T09:33:04.212Z
Retrieved
2026-10-14T16:41:56.195Z
Format
json-object
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/2b273621-db04-40ec-a7b1-94a2286ad301
Feed id
cybercrime-works
Provider record id
2b273621-db04-40ec-a7b1-94a2286ad301
Observed
2026-10-14T07:45:31.146Z
Source-published
2026-10-14T07:45:31.146Z
Retrieved
2026-10-14T07:41:52.901Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:236ab57ea4d14c7c0b659054c7204e7b575ee6e08fda987bc6443cf84c58c1ba
Observed
2026-10-14T05:09:09.396Z
Source-published
2026-10-14T00:00:00.000Z
Retrieved
2026-10-22T12:19:46.633Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:4848bc4db618ebc7cbe06eaba3243735ff77c4fda4f83ea14cfd1d66a8288c75
Observed
2026-10-14T05:09:09.396Z
Source-published
2026-10-14T04:54:04.000Z
Retrieved
2026-10-15T00:26:58.712Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-10-22T12:23:46.455Z; associated provider observation 2026-10-14T05:09:09.396Z.
Provider update: recorded 2026-10-15T00:30:53.744Z; associated provider observation 2026-10-14T05:09:09.396Z.
Provider update: recorded 2026-10-14T20:19:23.211Z; associated provider observation 2026-10-14T07:45:31.146Z.
Provider update: recorded 2026-10-14T07:46:13.127Z; associated provider observation 2026-10-14T07:45:31.146Z.
Initial tracker record: recorded 2026-10-14T07:43:57.175Z; associated provider observation 2026-10-14T09:33:04.212Z.