{
  "family": "zenpak",
  "sample_count": 27,
  "category": "ransomware",
  "description": "Zenpak (identified across antivirus telemetries under signatures including Ransom:Win32/Zenpak, Trojan-Ransom.Win32.Zenpak, and Trojan.Zenpak) is an evasive crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through malicious spam campaigns with macro-enabled document attachments, Zenpak executes rapid evasion and reconnaissance routines upon system infiltration. Zenpak terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Zenpak encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Zenpak",
    "Trojan-Ransom.Win32.Zenpak",
    "Trojan.Zenpak",
    "Win32/Zenpak",
    "Ransom:Win32/Zenpak.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Zenpak?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zenpak is a crypto-ransomware family that encrypts user documents with AES-256 and demands cryptocurrency ransom for recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zenpak prevent data recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin to purge Volume Shadow Copies and disables Windows automated startup recovery using bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by Zenpak for encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets business documents, spreadsheets, databases, archives, and multimedia files across local and network drives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zenpak infect enterprise computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam emails with weaponized attachments and compromised software download portals."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures effectively prevent Zenpak damage?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain offline immutable backups, enable Controlled Folder Access in Microsoft Defender, and restrict execution of unauthorized scripts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Macro Documents",
    "Exploit Kit Drive-by Compromise",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "AES-256 / RSA-2048 File Encryption",
    "Volume Shadow Copy Purging (vssadmin)",
    "Network Share Traversal & Locking",
    "Desktop Wallpaper Extortion Display",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system UID and generated encryption session keys to remote C2 servers",
      "Tor-routed payment portal communications for ransom negotiation"
    ],
    "evasion_techniques": [
      "Killing database and backup software processes via taskkill prior to encryption",
      "Dynamic API resolution through PEB hash lookups to conceal cryptographic API calls"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9cb3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1",
      "adc4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZenpakLocker",
      "HKCU\\Control Panel\\Desktop\\Wallpaper"
    ],
    "file_paths": [
      "%Temp%\\zenpak.exe",
      "%Desktop%\\HOW_TO_RESTORE_FILES.txt",
      "%AppData%\\Zenpak\\keys.dat"
    ]
  },
  "defensive_measures": [
    "Implement automated, air-gapped backups to ensure full recovery capability without ransom payments",
    "Enable Controlled Folder Access in Microsoft Defender to safeguard critical document repositories",
    "Block command-line invocations of vssadmin delete shadows using endpoint behavioral detection rules"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Zenpak",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Zenpak"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Zenpak",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Zenpak.A",
      "Ransom:Win32/Zenpak.B"
    ]
  },
  "motivation": "Financial Cybercrime & Extortion Ransom Payments",
  "sample_hashes": []
}