Benzona ransomware

Who Benzona is

Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics — encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.

Recorded activity

Disclosures attributed to Benzona in this database run from November 2025 to January 2026, totalling 14 victims — 0.1% of everything tracked here. Benzona has listed victims in 8 countries in this database, most often Romania, followed by France and India. The sectors appearing most in its listings are Healthcare, Manufacturing, Hospitality and Tourism.

Indicators of compromise

• 6e2189ab11f130ead644b1d5bd00f1ac
• 09f7432834ce15e701aa7fcc84a9c2441c1c7e0a9cb66a6211845be73d2597cc
• 179.43.139.126

Showing a sample of 1 MD5, 1 SHA256, 1 IP on file. Hashes and network indicators published for Benzona. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
benzona ransomware
*/

rule benzona_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.benzona"
        description = "Detects benzona ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "benzona" ascii nocase
        $name2 = "BENZONA" ascii
        $onion  = "benzona.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Benzona, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.