Benzona
| RaaS
Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics — encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.
Extension(s): .benzona
Victims
14
First Victim
2025-11-26
(est. attack date)
Discovery Date
2025-11-26
Last Seen
2026-01-30
Inactive Since
209
days
Avg Delay
N/A
attack→claim
Infostealer
35.7%
victims with domain
Countries
8
hit
Uptime
0.0% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
Exclusive interview with the ransomware group benzona
from the CyberSecurityIL Telegram Channel —
ransomware-interviews.base44.app
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Benzona Ransomware | No | 2026-08-22T08:35:36 |
benzona6x5ggng3hx52h4mak5sgx5vukrdlrrd3of54g2uppqog2joyd.onion
|
||||
|
Support Chat | No | 2026-08-22T08:35:49 |
rwsu75mtgj5oiz3alkfpnxnopcbiqed6wllyoffpuruuu6my6imjzuqd.onion
|
Target
Top 5 Activity Sectors
- Healthcare 3
- Manufacturing 3
- Retail & E-Commerce 2
- Hospitality 1
- Technology 1
Top 5 Countries
-
Romania
4
-
Guatemala
1
-
France
1
-
Tanzania, United Republic of
1
-
Iran, Islamic Republic of
1
Heatmap
Ransom Notes (1)
YARA Rules (1)
Indicators of Compromise (IoCs) (4)
Hash MD5
1
Hash SHA256
1
IP Address
1
Tox
1
Victims (14)
[AI generated] "Casamedica.com.gt" is a Guatemala-based company that provides a range of medical equ…
[AI generated] The Empreinte Hotel is a luxury establishment located in Orleans, France. This 4-star…
[AI generated] PlatinumOne.in is a company based in India that provides outsourced sales force servi…
[AI generated] "SUNNYGO.COM.TW" is an online retailer based in Taiwan. The company specializes in th…
