Ransomware group profile · #183 by claimed victims

Benzona ransomware

Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics — encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.

Active First seen Nov 2025 .benzona

14Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

8Countries hit

4Leak-site URLs tracked, 0 online

30 Jan 2026Latest claim recorded

Victimology

Who Benzona claims to have breached, from 14 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare3

Manufacturing3

Retail & E-Commerce2

Hospitality1

Technology1

Professional Services1

Top countries

Romania4

Guatemala1

France1

Cote d’Ivoire1

Tanzania1

Iran1

India1

Taiwan1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
casamedica.com.gt casamedica.com.gt	Healthcare	GT	30 Jan 2026
empreinte-hotel.com empreinte-hotel.com	Hospitality	FR	22 Jan 2026
aameia.com.g* aameia.com.g*	Not Found	—	22 Jan 2026
ccbrt.org ccbrt.org	Healthcare	TZ	17 Jan 2026
em**int-ho*.com emint-ho***.com	Not Found	—	17 Jan 2026
cc**.or.z cc**.or.z	Not Found	—	12 Jan 2026
taminsho.com taminsho.com	Retail & E-Commerce	IR	22 Dec 2025
platinumone.in platinumone.in	Technology	IN	6 Dec 2025
SUNNYGO.COM.TW sunnygo.com.tw	Retail & E-Commerce	TW	3 Dec 2025
suzuki-ploiesti.ro suzuki-ploiesti.ro	Manufacturing	RO	26 Nov 2025
poliserv.ro poliserv.ro	Professional Services	RO	26 Nov 2025
mazda-ploiesti.ro mazda-ploiesti.ro	Manufacturing	RO	26 Nov 2025

All 14 Benzona victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Benzona is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Benzona ransomware still active?

Benzona is tracked as active. The most recent leak-site claim VULONE recorded is dated 30 January 2026.

How many victims has Benzona claimed?

VULONE has recorded 14 leak-site victim claims attributed to Benzona since November 2025, across 8 countries and 7 sectors.

Which industries does Benzona target?

The sectors most often named on the Benzona leak site are Healthcare, Manufacturing, Retail & E-Commerce.

Which countries are most affected by Benzona?

Most Benzona victims recorded by VULONE are located in Romania, Guatemala, France.

Where does VULONE get Benzona victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].