ZAWOOO (tracked on leak monitors as ZaWoo) is a 2026 extortion ransomware with a Linux encryptor built for NAS and server storage. It discards both the original file name and extension, leaving files with random hexadecimal names and a build-specific random suffix, so the recognisable artefact is the note How To Restore Your Files.txt. The note brands the attackers as a crew that values its reputation, pitches payment as a paid security test, tells the victim to avoid police and to obscure the purpose of any bitcoin purchase, and lists a Session ID and an onionmail address. The group threatens to send stolen files and mailbox content to the victim's customers and runs a Tor leak site. Each build embeds a single victim ID, indicating one compiled payload per target. No link to an earlier family has been documented.
Ransom note filenames: How To Restore Your Files.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161