zawoo
ransomware group · aka Zawoo · unknown · active since 2026-08-29 (first tracked leak-site activity on this dashboard; any earlier activity: unknown)
Victims · 7d
0flat
Victims · 30d
19active targets
Victims · 90d
19
All-time (tracked)
19since 2026-08-29
Last post
08-31 16:32UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Zawoo is a ransomware and data-extortion group that operates a public leak site naming victims, with the dashboard's first tracked posting on 2026-08-29. It has listed 19 victims to date, with the most recent posting on 2026-08-31. The victim set consists mostly of small and mid-sized organizations, with a strong concentration of German-language victims alongside others in New Zealand and the United States. Public vendor research on the group's malware, initial access methods, and infrastructure is currently unknown to this dashboard. No ransom-payment or revenue figures have been publicly reported.
Tactics & tooling
- Operates a leak site naming victims, consistent with data-theft extortion (observed via leak-site postings)
- Occasionally lists victims anonymously using random 'Company ID' placeholders (observed)
- Targets small and mid-sized businesses, including regional German organizations (observed from victim list)
- Burst-style posting cadence, with 19 victims listed within days of first appearance (observed)
- Initial access, encryption, and exfiltration techniques: unknown (no public vendor reporting identified)
Targeted sectors
manufacturingprofessional servicessoftwarehospitalityreal estatefacility servicessocial services
Notable public victims
zenithtechnology.co.nz, fes-sport.de, esopartnerscpa.com, vectorsoft.de, winterdienst-berlin.com, hd-werkstaetten.de, ng-engineering.de, berghotel-oberhof.de, rsk-immobilien.de
Estimated earnings
No public figure.
Leak-site victims19 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| zenithtechnology.co.nz | · 15d ago | country: New Zealand | fileSize: 72009692411 | PUBLISHED | Zenith Technology Corporation Limited (ZenTech) is a New Zealand-based Contract Research Organisation (CRO) headquartered in Dunedin, New Zealand. The company was incorporated in 1987 and specializes in clinical research and pharmaceutical analytical services for the international pharmaceutical industry. |
| fes-sport.de | · 15d ago | country: German | fileSize: 49760098079 | PUBLISHED | FES Sport (fes-sport.de) is the Institut für Forschung und Entwicklung von Sportgeräten (FES), a German institute specializing in research, engineering, and development of high-performance sports equipment and technology. It is based in Berlin, Germany, with an additional facility in Oberhof. |
| esopartnerscpa.com | · 15d ago | country: USA | fileSize: 90147829401 | PUBLISHED | ESOP Partners appears to be a specialized professional-services firm focused on Employee Stock Ownership Plans (ESOPs) rather than a general-purpose CPA firm. |
| Company ID : mtfszhtggfdsg | · 16d ago | country: New Zealand | fileSize: 72009692411 | UNPUBLISHED |
| Company ID : htrfdrghbtnyr | · 16d ago | country: German | fileSize: 49760098079 | UNPUBLISHED |
| Company ID : vrfdeyhnbyuki | · 16d ago | country: USA | fileSize: 90147829401 | UNPUBLISHED |
| vectorsoft.de | · 16d ago | country: German | fileSize: 17073414449 | PUBLISHED | vectorsoft is Vectorsoft AG, a German software-development company headquartered in Heusenstamm, Hesse, near Frankfurt am Main, Germany. |
| winterdienst-berlin.com | · 16d ago | country: Germany | fileSize: 35134085775 | PUBLISHED | The company is located at Boschweg 18–20, 12057 Berlin, and lists [email protected] and +49 30 684 083-6 as contact details. According to their company website, their services include:Snow and slush removal Clearing and gritting of sidewalks, roads, parking areas and public spaces Manual and machine-assisted winter maintenance Winter-service operations for businesses, private households and municipalities GPS-supported fleet and quality controls Environmentally conscious winter-service methods.Availability around the clock during winter conditions .The company says it combines around 30 years of experience with modern technology and environmentally friendly materials. |
| hd-werkstaetten.de | · 16d ago | country: Germany | fileSize: 37740752817 | PUBLISHED | hd-werkstaetten.de belongs to Heidelberger Werkstätten der Lebenshilfe Heidelberg e. V., a German social enterprise / sheltered workshop organization supporting people with disabilities through employment, vocational training, and workplace inclusion. Its main site is in Heidelberg, Baden-Württemberg, Germany. |
| ng-engineering.de | · 16d ago | country: German | fileSize: 4674304337 | PUBLISHED | NG Engineering Gruppe is a German engineering and technical-services group headquartered in Rödental, Bavaria. The group has been operating for more than 20 years and has locations in Germany, Poland and the Czech Republic. It provides engineering services throughout the product-development process and also offers personnel/recruitment services. |
| berghotel-oberhof.de | · 16d ago | country: Germany | fileSize: 4300776316 | PUBLISHED | Konsumhotel Berghotel Oberhof is a wellness and leisure hotel in Oberhof, Thuringia, Germany, located in the Thuringian Forest. It is operated by Berghotel Oberhof GmbH, with Markus Barth as managing director. |
| rsk-immobilien.de | · 16d ago | country: German | fileSize: 34483870629 | PUBLISHED | RSK Immobilien GmbH is a German real-estate project developer and property company headquartered in Weißenfels, Saxony-Anhalt. Its core activities are the development, realization, renovation and marketing of residential and commercial properties, with a strong current focus on residential projects. |
| montronix.de | · 16d ago | country: German | fileSize: 14756317234 | PUBLISHED | MONTRONIX GmbH is a German industrial technology company specializing in machine-tool monitoring, process monitoring, machine protection, and condition monitoring. The company was founded in 1990 as a spin-off of Kennametal, Inc. and focuses primarily on monitoring solutions for metal-cutting and machining operations. |
| kdynium.cz | · 16d ago | country: Kdyně, Czech Republic | fileSize: 22341828166 | PUBLISHED | KDYNIUM a. s. is a Czech precision foundry based in Kdyně, Plzeň Region, specializing in precision castings made using the lost-wax (investment casting) process. The company says its foundry has been operating since 1954, while the current joint-stock company was incorporated in 1992. |
| frm.ind.br | · 16d ago | country: Brazil | fileSize: 41747673590 | PUBLISHED | FRM - Fábrica de Rolamentos e Mancais Ltda is a Brazilian industrial manufacturer specializing in bearings, bearing housings, and industrial movement solutions. The company is based in Curitiba, Paraná, Brazil and has been operating since 1980. |
| acqbuilt.com | · 16d ago | country: Canada | fileSize: 34895272422 | PUBLISHED | company based in Edmonton, Alberta, Canada. It specializes in using factory-based construction methods to build residential homes faster, with more precision, and with reduced waste compared with traditional on-site building. |
| BOTEC-CZ | · 16d ago | country: German | fileSize: 29524637347 | PUBLISHED | boTec helps companies in process and production industries improve efficiency, manage data, and optimize business operations using software solutions, consulting, and integration services. |
| n-tree.com | · 16d ago | country: Austria | fileSize: 70788003456 | PUBLISHED | They develop software and hardware solutions mainly for visitor management and ticketing systems used by: swimming pools and wellness centers, museums and exhibitions, leisure parks, climbing gyms and fitness facilities, mountain railways and ski lifts, industrial visitor systems. Their main locations include: Bregenz, Austria (head office), Delitzsch, Germany, Heimberg, Switzerland, Riazzino, Switzerland/Italian region. |
| Company ID : adscynfdkjuih | · 16d ago | country: Germany | fileSize: 18677604120 | UNPUBLISHED |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .