Actor Profile

🏹 benzona — Ransomware

Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics — encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.

🔄 Pivot:🌎 RO 🏹 benzona

Classification

Ransomware

Leak-site victims

Ransomware.live

Associated IoCs

local intel

MITRE techniques

—

ATT&CK

Tracked

Yes

Ransomware.live

PIVOT🔍 Advanced Search 🕵 OSINT Pivot 🔗 Link Analysis 🕑 Timeline 📤 Export STIX/MISP

🔥 Leak-Site Victims (14)

Victim	Country	Published	Domain
casamedica.com.gt	GT	2026-01-30T17:29:04.506216+00:00	`casamedica.com.gt`
empreinte-hotel.com	FR	2026-01-22T12:00:58.873452+00:00	`empreinte-hotel.com`
aameia.com.g*		2026-01-22T12:00:28.537370+00:00	`aameia.com.g*`
ccbrt.org	TZ	2026-01-17T09:25:01.716705+00:00	`ccbrt.org`
em**int-ho***.com		2026-01-17T09:24:34.732345+00:00	`em**int-ho***.com`
cc**.or.z		2026-01-12T11:38:06.173558+00:00	`cc**.or.z`
taminsho.com	IR	2025-12-22T07:41:54.995816+00:00	`taminsho.com`
platinumone.in	IN	2025-12-06T13:19:29.920249+00:00	`platinumone.in`
SUNNYGO.COM.TW	TW	2025-12-03T15:13:49.772808+00:00	`SUNNYGO.COM.TW`
suzuki-ploiesti.ro	RO	2025-11-26T17:47:28.218991+00:00	`suzuki-ploiesti.ro`
poliserv.ro	RO	2025-11-26T17:47:00.177613+00:00	`poliserv.ro`
mazda-ploiesti.ro	RO	2025-11-26T17:46:35.239553+00:00	`mazda-ploiesti.ro`
dacia-ploiesti.ro	RO	2025-11-26T17:46:10.561847+00:00	`dacia-ploiesti.ro`
sevci.org	CI	2025-11-26T17:45:45.422373+00:00	`sevci.org`

Source: Ransomware.live leak-site monitoring (cached, offline-safe).

MITRE ATT&CK Groups ↗ Ransomware.live ↗ APT Theater →

📁 Case Management

Attach to case

Role

+ New case from this

🏹 Campaigns & malware

Campaigns →Malware families →Nation-State theater →Sanctions →Wanted & Rewards →

🏹 Add to case

Attach benzona (Actor / APT) and pull all linked entities: pull linked

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →

Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook