{
  "family": "zonidel",
  "sample_count": 19,
  "category": "ransomware",
  "description": "Zonidel (tracked across antivirus telemetry under signatures including Ransom:Win32/Zonidel, Trojan-Ransom.Win32.Zonidel, and Win32/Zonidel) is a destructive Windows crypto-ransomware family discovered targeting corporate networks and individual workstations. Distributed through weaponized email phishing links, software crack archives, and malicious download aggregators, Zonidel executes pre-encryption enumeration upon execution. It invokes administrative system tools via cmd.exe to purge volume shadow copies ('vssadmin delete shadows /all /quiet'), delete system backup catalogs ('wbadmin delete catalog -quiet'), and disable automatic system startup recovery ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'). Zonidel then iterates across local storage drives and mounted network shares, encrypting documents, databases, images, and archives using AES-256 in CBC mode, appending the '.zonidel' extension to locked files. It secures the AES symmetric session key using an embedded 2048-bit RSA master public key, and generates ransom demand notes ('ZONIDEL_DECRYPT_NOTE.txt') across all processed directories with instructions to contact operators via Tor portals.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Zonidel",
    "Trojan-Ransom.Win32.Zonidel",
    "Win32/Zonidel",
    "Ransom.Zonidel",
    "Zonidel Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Zonidel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zonidel is a crypto-ransomware family that encrypts local disks and network shares using AES-256 and RSA-2048 cryptography."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zonidel prevent victims from restoring files from shadow copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs vssadmin and wbadmin commands to delete volume shadow copies and system backup catalogs."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zonidel spread to victim machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via phishing email attachments, deceptive software installers, and bundled cracking utilities."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted with the .zonidel extension be decrypted without the key?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decryption tool exists because the AES symmetric keys are encrypted with an asymmetric RSA-2048 public key."
      }
    },
    {
      "@type": "Question",
      "name": "What incident response actions should be taken upon detecting Zonidel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately disconnect infected devices from the corporate network, capture memory artifacts, and restore data from isolated backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Obfuscated Macro Attachments",
    "Trojanized Software Installers and Cracks",
    "Remote Desktop Protocol (RDP) Brute-Forcing"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256-CBC + RSA-2048)",
    "Automated Shadow Copy & Backup Deletion",
    "Service Termination (Databases, Hypervisors, Antivirus)",
    "Local Disk & Network Directory Traversal",
    "Automated Ransom Note Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor network nodes or anonymous web relay proxies",
      "SMB reconnaissance traffic scanning adjacent internal subnets"
    ],
    "evasion_techniques": [
      "Terminating security software processes to prevent behavioral blocking",
      "Dynamic API resolution to hide file encryption and disk traversal calls"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a",
      "d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZonidelLocker"
    ],
    "file_paths": [
      "%AppData%\\Zonidel\\zonidel.exe",
      "C:\\ZONIDEL_DECRYPT_NOTE.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure full recovery without ransom payments",
    "Block execution of vssadmin and wbadmin by non-administrative users using application control policies",
    "Deploy endpoint detection and response (EDR) rules detecting anomalous bulk file modifications"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Zonidel",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Zonidel"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Zonidel",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Zonidel.A",
      "Ransom:Win32/Zonidel.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}