Ransomware needs a way in. Stolen credentials are the cheapest one.
zawoo Ransomware Group
Ransomware group profile
Description
Zawoo is a financially motivated ransomware group that emerged in August 2026, targeting small to mid-sized enterprises. The group uses hands-on-keyboard methods and has an extortion data leak site for publishing victim details. It targets organizations mainly in German-speaking Europe, North America, South America, and the Asia-Pacific region.
Key insights
- •Targets small to mid-sized enterprises across various sectors, primarily in German-speaking regions and globally.
- •Gains unauthorized access through compromised VPN credentials without multi-factor authentication.
- •Utilizes custom PowerShell scripts for credential harvesting and data collection.
- •Encrypts files using ransomware that renames them to hexadecimal strings.
- •Employs tactics like lateral movement via Remote Desktop Protocol and PsExec.
- •Maintains a Tor leak site to threaten victims with public exposure unless ransoms are paid.
Threat Level & Status Breakdown
For zawoo · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for zawoo in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for zawoo
T1003
OS Credential Dumping
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1203
T1203
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(31)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| hd-werkstaetten.de | Germany | Claimed | 9 days ago | |
| montronix.de | Germany | Claimed | 9 days ago | |
| vectorsoft | Germany | Claimed | 9 days ago | |
| Heidelberger Werkstätten | Germany | Claimed | 9 days ago | |
| ACQBUILT | Canada | Claimed | 9 days ago | |
| KDYNIUM | Czech Republic | Claimed | 9 days ago | |
| Berghotel Oberhof | Germany | Claimed | 9 days ago | |
| Winterdienst-Gesellschaft SÜD-OST | Germany | Claimed | 9 days ago | |
| n-tree solutions Ticketsysteme GmbH | Austria | Claimed | 9 days ago | |
| FRM - Fabrica de Mancais, Rolamentos e Soluções Industriais | Brazil | Claimed | 9 days ago | |
| FRM - Fábrica de Mancais, Rolamentos e Soluções Industriais | Brazil | Claimed | 9 days ago | |
| BOTEC-CZ | — | Claimed | 9 days ago | |
| RSK Immobilien GmbH | Germany | Claimed | 9 days ago | |
| NG Engineering | Germany | Claimed | 9 days ago | |
| ng-engineering.de | Germany | Claimed | about 1 month ago | |
| fes-sport.de | Germany | Claimed | about 1 month ago | |
| esopartnerscpa | United States | Claimed | about 1 month ago | |
| AMB | France | Claimed | 15 days ago | |
| Cabinet Agiliance | France | Claimed | 15 days ago | |
| FRANCARE Industries | France | Claimed | 15 days ago |
Page 1 of 2
Affected countries(12)
Countries where this group has been reported to target or leak victims.