{
  "family": "powzip",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Powzip (classified in threat intelligence feeds as Ransom:Win32/Powzip and Trojan-Ransom.Win32.Powzip) is an unusual crypto-ransomware family that leverages PowerShell scripting and compressed ZIP archive encryption primitives to lock victim files. Propagated through weaponized macro documents and trojan loaders, Powzip executes PowerShell commands to enumerate user documents across local and network drives. Instead of compiling custom cryptographic binaries, Powzip packages discovered files into password-protected ZIP archives using randomly generated high-entropy passwords, deletes the original uncompressed files, and renames the archives with .powzip extensions. It drops ransom notes directing victims to contact the threat actor to obtain the ZIP archive decryption password.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Powzip",
    "Trojan-Ransom.Win32.Powzip",
    "Win32/Powzip",
    "Powzip Ransomware",
    "Ransom.Powzip"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Powzip?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Powzip is a ransomware family that uses PowerShell scripts to archive victim files into password-protected ZIP files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Powzip lock files without standalone encryption binaries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes PowerShell scripts that compress target files into password-protected ZIP archives and deletes the originals."
      }
    },
    {
      "@type": "Question",
      "name": "How does Powzip distribute itself?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via phishing emails containing weaponized macro documents or malicious script loaders."
      }
    },
    {
      "@type": "Question",
      "name": "Does Powzip delete shadow copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it invokes PowerShell to execute vssadmin commands that delete Volume Shadow Copies to hinder recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders mitigate Powzip attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enable PowerShell Constrained Language Mode, enforce script signing policies, and maintain offline data backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.001",
    "T1486",
    "T1490",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Powzip from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Powzip persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Powzip attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Powzip modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Powzip dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Powzip",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Powzip"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Command and Scripting Interpreter: PowerShell (T1059.001)",
      "url": "https://attack.mitre.org/techniques/T1059/001/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}