Inside a Zawoo Team Intrusion
Excerpt
Certainity — September 2026
Redaction: hostnames, domains and internal addresses are replaced with <domain> , <HOST> , 10.x.x.x , and the encryptor’s file extension with <EXT> . Details that would identify the victim organisation or its sector have been removed.
TL;DR
Who: Zawoo Team, active by early August 2026 at the latest. No leak site until 30th August, when 19 victims went up at once — concentrated in the DACH region, ranked top-three trending on ransomlook.io. Almost nothing published on their tradecraft / TTP before this.
This case: we worked it before the leak site existed, so we caught the group with no public reporting…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by certainity.com on certainity.com.