ZaWoo

MITRE ATT&CK does not currently catalogue ZaWoo, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: ZaWoo executes malicious payloads via PowerShell to automate reconnaissance and persistence on compromised hosts.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1685 Disable or Modify Tools Defense Impairment

   What they do: ZaWoo disables security tools by terminating antivirus processes and modifying system defenses to hinder recovery.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

3. T1027.013 Encrypted/Encoded File Stealth

   What they do: ZaWoo encrypts and encodes victim files with custom symmetric keys to ensure data remains inaccessible.

   What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

4. T1070.004 File Deletion Stealth

   What they do: ZaWoo deletes Volume Shadow Copies and backup directories via vssadmin to prevent data restoration.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

5. T1564.003 Hidden Window Stealth

   What they do: ZaWoo hides malicious processes and command execution behind hidden windows to evade detection.

   What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

6. T1083 File and Directory Discovery Discovery

   What they do: ZaWoo performs file and directory discovery to identify sensitive assets and prepare encryption targets.

   What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

7. T1135 Network Share Discovery Discovery

   What they do: ZaWoo uses network share discovery to locate victim file shares and target critical data across the network.

   What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

8. T1614.001 System Language Discovery Discovery

   What they do: ZaWoo discovers system language settings to tailor ransom notes and localization of malicious communications.

   What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

9. T1560.001 Archive via Utility Collection

   What they do: ZaWoo archives stolen data using utility commands for potential exfiltration and extortion demands.

   What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

10. T1486 Data Encrypted for Impact Impact

    What they do: ZaWoo encrypts victim files using custom ransomware routines to maximize operational disruption and extortion leverage.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

11. T1489 Service Stop Impact

    What they do: ZaWoo stops critical Windows services such as backup and monitoring services to disrupt incident response.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

12. T1490 Inhibit System Recovery Impact

    What they do: ZaWoo inhibits system recovery by corrupting restore points and disabling backup services before encryption.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

Please contact with your ID : [SNIP]
~~~ You have been attacked by ZAWOOO - a ransomware that prioritizes reputation. ~~~~

>>>>> The file will have three different suffixes, don't worry, this is a normal phenomenon and can be decrypted.

>>>>> Your data will be published on the Dark Web, download Onion Browser to visit.
    https://fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynrnlomu4szf2nyd.onion

>>>>> You must pay us.
    I know you may have other file backups, but there is no backup of the customer's privacy and trust.
    We will disclose your data and send the download link to your customers and the GDPR (Data Protection Authorities). 
    Instead of paying huge data breach fines and losing customers, it's better to choose to cooperate with us
    
>>>>> What is the guarantee that we won't scam you?
    We are not a politically motivated group and want nothing but financial rewards for our work. 
    If we defraud even one client, other clients will not pay us. 
    
>>>>>If you pay the ransom, we will fulfill all the terms we agreed during the negotiation process. 
     Otherwise, we may consider sending your files, chat history, mailbox content, etc. to all your customers by email.
     
>>>>> You can think of this paid decryption as a security test. 
      We will tell you the entire intrusion process, give you security advice, and help you protect your system. 
      This amount may be cheaper than finding a security company for testing.
      
>>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files!
      
>>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. 
      They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.

>>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. 
      Some brokers, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, 
      such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, 
      cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations,  
      buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, 
      or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency.

>>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, 
      such as https://electrum.org/ or any other cold cryptocurrency wallet, 
      more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, 
      you will avoid any problems from regulators, police and brokers.

>>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, 
      it's not your fault if you are very scared. Not a single company that paid us has had issues. 
      Any excuses are just for insurance company to not pay on their obligation.

>>>>> You can contact us in the following ways:
1. Download and install  the session: https://getsession.org/, 
   our session ID: 05b0794c896a54271d3d39c3b395d86aee2d5c05f196c59f3781bac1b1ac1a1a12
2. Send email: [email protected]
In order to ensure that you can receive the message, please send the message in two ways at the same time

Ransom-note text from RansomLook, licensed CC BY 4.0.