{
  "family": "qzonit",
  "sample_count": 20,
  "category": "ransomware",
  "description": "Qzonit (cataloged across global antimalware repositories under designations including Ransom:Win32/Qzonit, Trojan-Ransom.Win32.Qzonit, and Win32/Qzonit) is a targeted crypto-ransomware family designed to lock enterprise and consumer Windows workstations. Distributed via spearphishing emails carrying malicious archive attachments and trojanized freeware repacks, Qzonit initiates rapid file system discovery. It locates and encrypts business files including spreadsheets, databases, documents, and archives using AES-256 encryption with RSA key protection, appending the .qzonit extension to encrypted files. Qzonit executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion banner, and leaves text ransom notes directing victims to contact attackers via darknet email or Tor portals.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Qzonit",
    "Trojan-Ransom.Win32.Qzonit",
    "Win32/Qzonit",
    "Ransom.Qzonit",
    "Ransom:Win32/Qzonit.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Qzonit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Qzonit is a crypto-ransomware family that encrypts files on Windows endpoints and demands cryptocurrency ransom for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Qzonit destroy shadow copy recovery points?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet to purge all Volume Shadow Copies on local volumes."
      }
    },
    {
      "@type": "Question",
      "name": "What file extension does Qzonit append to encrypted files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends the .qzonit extension to encrypted files alongside unique victim identifiers."
      }
    },
    {
      "@type": "Question",
      "name": "How is Qzonit delivered to target computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious email attachments, Trojanized downloads, and drive-by web exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations recover from a Qzonit attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network, remove ransomware binaries, and restore encrypted data from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Qzonit",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Qzonit"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Qzonit",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_qzonit"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Qzonit",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Qzonit"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from network segments immediately to prevent encryption spreading across shares.",
    "Kill active ransomware processes using Task Manager or elevated PowerShell commands.",
    "Capture memory dumps and binary samples for malware analysis and IOC attribution.",
    "Block delivery domains and malicious sender email addresses at perimeter firewalls.",
    "Restore files from air-gapped, immutable backup archives."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency ransom demand; it funds cybercrime without guaranteeing decryption key delivery.",
    "Do not connect backup storage media to affected computers before ensuring the system is clean."
  ],
  "target_industries": [
    "Manufacturing",
    "Healthcare",
    "Retail",
    "Commercial Businesses"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}