Benzona

MITRE ATT&CK does not currently catalogue Benzona, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: benzona executes PowerShell scripts to run payload logic, disable defenses, and propagate across systems.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1685 Disable or Modify Tools Defense Impairment

   What they do: benzona disables or modifies security tools such as EDR agents and monitoring services to evade detection.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

3. T1070.004 File Deletion Stealth

   What they do: benzona deletes Volume Shadow Copies and backup artifacts via system commands to prevent recovery.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

4. T1018 Remote System Discovery Discovery

   What they do: benzona performs remote system discovery to identify additional hosts and network topology.

   What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

5. T1057 Process Discovery Discovery

   What they do: benzona performs process discovery to identify active services and processes for disruption or privilege escalation.

   What that means: Adversaries may attempt to get information about running processes on a system.

6. T1135 Network Share Discovery Discovery

   What they do: benzona uses network share discovery to locate victim file shares and staging directories for encryption targets.

   What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

7. T1021.002 SMB/Windows Admin Shares Lateral Movement

   What they do: benzona uses SMB/Windows Admin Shares for lateral movement between networked hosts.

   What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

8. T1486 Data Encrypted for Impact Impact

   What they do: benzona encrypts victim files and data stores using its ransomware payload to maximize impact.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

9. T1489 Service Stop Impact

   What they do: benzona stops critical services and processes to disrupt operations before or during encryption.

   What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

10. T1490 Inhibit System Recovery Impact

    What they do: benzona inhibits system recovery by destroying backups, disabling restore mechanisms, and altering recovery settings.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

ATTENTION! Your files have been encrypted by Benzona Ransomware.

Sensitive data has been exfiltrated. Do not attempt to decrypt files yourself - this will lead to irreversible data loss and information leak.

WHAT YOU MUST NOT DO:
- Do not use recovery tools
- Do not rename files
- Do not contact law enforcement

You have 72 hours to contact us:

TO START NEGOTIATIONS:
1. Download TOR Browser: https://www.torproject.org/download/
2. Install and open TOR Browser
3. Go to our chat: http://rwsu75mtgj5oiz3alkfpnxnopcbiqed6wllyoffpuruuu6my6imjzuqd.onion/
4. Enter your Chat ID: [SNIP]

News public:
https://benzona6x5ggng3hx52h4mak5sgx5vukrdlrrd3of54g2uppqog2joyd.onion/

After deadline your data will be sold or published. Follow our instructions to avoid reputational losses.

Ransom-note text from RansomLook, licensed CC BY 4.0.