Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Benzona
As of Oct 19, 2026, Benzona has listed 11 confirmed victims on its leak site since Nov 26, 2025, 0.0% of all victims tracked by Brandefense. Its most targeted country is Romania (36.4% of its victims) and its most targeted sector is Healthcare.
Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics, encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 11
- Rank By Victims
- #219
- Last Leak-Site Post
- Jan 30, 2026
- Top Country
- Romania
- Top Sector
- Healthcare
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 5 |
| December 2025 | 3 |
| January 2026 | 3 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 5 |
| December 2025 | 3 |
| January 2026 | 3 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Benzona Victims.
Search all 11 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| casamedica.com.gt casamedica.com.gt | GTGuatemala | Healthcare | 300 GB | |
| empreinte-hotel.com empreinte-hotel.com | FRFrance | Hospitality and Tourism | 80 GB | |
| ccbrt.org ccbrt.org | TZTanzania | Healthcare | 1.8 TB | |
| taminsho.com taminsho.com | IRIran | Government and Public Sector | 80 GB | |
| platinumone.in platinumone.in | INIndia | Unknown | 800 GB | |
| SUNNYGO.COM.TW sunnygo.com.tw | TWTaiwan | Unknown | Not stated |
How They Operate.
Benzona's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Benzona Targets.
History.
Busiest month on record: 5 confirmed victims
First seen in Brandefense data
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.