Detronics Pte Ltd

This record is a provider-reported ransomware claim attributed to Orova. It is an allegation and has not been independently confirmed.

Claim context

Group-published claim date: 2026-10-13T00:00:00.000Z
First tracked: 2026-10-13T11:07:34.325Z
Last observed: 2026-10-13T17:17:44.266Z
Monitoring providers: 4
Independent monitoring providers: 4
Post URL: https://cti.fyi/
Data source: unified
Duplicate records merged: 4

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-10-13T17:17:44.266Z; source-published 2026-10-13T17:17:44.266Z; retrieved 2026-10-13T15:41:46.994Z.
Monitoring provider: observed 2026-10-13T17:17:44.266Z; source-published 2026-10-13T17:17:44.266Z; retrieved 2026-10-14T16:41:56.195Z.
Monitoring provider: observed 2026-10-13T15:28:03.278Z; source-published 2026-10-13T15:28:03.278Z; retrieved 2026-10-13T15:41:46.994Z.
Monitoring provider: observed 2026-10-13T11:07:34.325Z; source-published 2026-10-13T00:00:00.000Z; retrieved 2026-10-22T12:19:46.633Z.
Monitoring provider: observed 2026-10-13T11:07:34.325Z; source-published 2026-10-13T07:34:42.000Z; retrieved 2026-10-14T00:11:49.998Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:a3c615b3e3ec22dc4442e90d712bdf90bfaff644df1f9a0f1f430030b150a7cf
MISP event UUID
6314518d-36cc-518c-86da-29fee4d60f04
Observed
2026-10-13T17:17:44.266Z
Source-published
2026-10-13T17:17:44.266Z
Retrieved
2026-10-13T15:41:46.994Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
Darkfield by Orizon
Provider URL
https://darkfield.orizon.one/victims/39e30222-99ed-4fef-9b61-f98f83ab510f
Feed id
darkfield
Provider record id
39e30222-99ed-4fef-9b61-f98f83ab510f
Observed
2026-10-13T17:17:44.266Z
Source-published
2026-10-13T17:17:44.266Z
Retrieved
2026-10-14T16:41:56.195Z
Format
json-object
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/d2a230ca-20d2-4d23-b74c-6a2308e5f743
Feed id
cybercrime-works
Provider record id
d2a230ca-20d2-4d23-b74c-6a2308e5f743
Observed
2026-10-13T15:28:03.278Z
Source-published
2026-10-13T15:28:03.278Z
Retrieved
2026-10-13T15:41:46.994Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:de7d411c642dee2948a811d15722e0617577fcb40f087a23ad93660575cad364
Observed
2026-10-13T11:07:34.325Z
Source-published
2026-10-13T00:00:00.000Z
Retrieved
2026-10-22T12:19:46.633Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:3617ba315a453ff221cd7e869556565aec3d3b14e7c28078e4d3d8cc38978c6a
Observed
2026-10-13T11:07:34.325Z
Source-published
2026-10-13T07:34:42.000Z
Retrieved
2026-10-14T00:11:49.998Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-10-22T12:23:46.455Z; associated provider observation 2026-10-13T11:07:34.325Z.
Provider update: recorded 2026-10-14T00:15:30.824Z; associated provider observation 2026-10-13T11:07:34.325Z.
Provider update: recorded 2026-10-13T15:46:15.098Z; associated provider observation 2026-10-13T15:28:03.278Z.
Initial tracker record: recorded 2026-10-13T15:43:53.943Z; associated provider observation 2026-10-13T17:17:44.266Z.