Benzona
A Windows ransomware strain reported by CYFIRMA in December 2025. Its ransom note claims data was stolen as well as encrypted and sets a 72-hour deadline. Little else has been published.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
Only one credible source was available to us. CYFIRMA found Benzona while monitoring underground forums and describes a Windows strain whose note claims files were both encrypted and stolen, with a threat to leak or sell the data if contact is not made within 72 hours.1
CYFIRMA assesses that it follows a double extortion model and that its tactics resemble ransomware-as-a-service operations. That is a resemblance, not evidence of how the group is run.1 The sources we reviewed do not establish a UK link or any sector focus.
Key Techniques
Service Stop and Inhibit System Recovery are from CYFIRMA's mapping. We added encryption from its description.1 ATT&CK v20 has no entry for this group.
Vulnerabilities
The sources we reviewed do not tie a CVE to Benzona.
Defences That Matter
Are Your Windows Hosts Fully Covered?
We can help you check your endpoint coverage and recovery plans.
Sources
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.