Benzona
Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics — encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.
Threat level
LOW
Get an alert if one of your domains is named on a ransomware leak site.
Indicators of Compromise (IOCs)
IP addresses
1- 179.43.139.126
Get the complete IOC feed
The full IOC database by API, ready for your SIEM or SOAR.
Create free accountNo credit card required · Free API key
Known infrastructure
The following Tor hidden services have been associated with this group:
Benzona RansomwareSupport Chat
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Benzona’s victim list.
risk score · threat categories · sources · age · confidence — in one request