{
  "family": "elzob",
  "sample_count": 22,
  "category": "ransomware",
  "description": "Elzob (identified in security research telemetry as Ransom:Win32/Elzob, Trojan-Ransom.Win32.Elzob, and Win32/Elzob) is an aggressive Windows ransomware family active in opportunistic cybercrime attacks. Delivered via phishing campaigns and compromised freeware installers, Elzob scans local disk partitions, removable media, and mapped SMB shares for critical files including documents, spreadsheets, photos, and databases. It encrypts identified targets using symmetric encryption paired with public-key cryptography, renaming affected files with an extension such as .elzob or .locked. To maximize leverage and prevent local remediation, Elzob executes shell commands executing vssadmin to eliminate Volume Shadow Copies and modifies bootloader configurations via bcdedit to disable automated startup repairs. It leaves text extortion notes across encrypted directories directing victims to contact operators via Tor or darknet portals.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Elzob",
    "Trojan-Ransom.Win32.Elzob",
    "Win32/Elzob",
    "Ransom.Elzob",
    "Ransom:Win32/Elzob.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Elzob?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Elzob is a crypto-ransomware family targeting Windows systems, encrypting user files and demanding cryptocurrency for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Elzob prevent shadow copy recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to silently delete all Volume Shadow Copies and uses bcdedit to disable automated repair."
      }
    },
    {
      "@type": "Question",
      "name": "What storage devices are targeted by Elzob?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates and encrypts files on local hard drives, USB external media, and connected network file shares."
      }
    },
    {
      "@type": "Question",
      "name": "How is Elzob ransomware delivered to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious email attachments, Trojanized downloads, and drive-by web compromise."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery procedure for Elzob?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network immediately, remove malware binaries, verify backup integrity, and restore files from clean offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Elzob",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Elzob"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Elzob",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_elzob"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Elzob",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Elzob"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected endpoint from LAN, WAN, and Wi-Fi immediately to halt encryption across shares.",
    "Kill active ransomware processes via Windows Task Manager or elevated PowerShell commands.",
    "Preserve forensic evidence including memory dumps and ransomware binaries for hash attribution.",
    "Block delivery vectors, including malicious sender domains and external command hosts.",
    "Restore encrypted files from air-gapped, immutable backup archives."
  ],
  "what_to_avoid": [
    "Do not pay the extortion demand; decryption keys are not guaranteed and payment funds illicit groups.",
    "Do not reboot systems before securing volatile memory data."
  ],
  "target_industries": [
    "Manufacturing",
    "Retail",
    "Professional Services",
    "Healthcare"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}