Ransomware .PIZ 2026: From Threat Intelligence to 8 Cases at TUNGTEK

01 / IDENTIFICATION

What is .PIZ, and why does it matter?

In recent cases received by TUNGTEK, .piz is an extension appended to ransomware-affected filenames, often in the form filename.ext.piz. These incidents extend beyond personal computers to Windows Server, file servers, SQL/ERP databases, backups and data directly supporting business operations.

In public CTI from 2026, 360 Security tracks the keyword piz under the family Pizhon. This is a research reference, rather than proof that all files with the same extension were produced by one malware sample or attacker group. [1]

The fingerprint TUNGTEK is tracking

Read the indicators together. Extensions, emails and ransom note templates can be reused. Deeper classification requires comparison of samples, file structure, behavior and evidence from the affected system itself.

02 / EVIDENCE SCOPE

Public CTI and field observations are separate evidence layers

Public threat intelligence describes how researchers have characterized a family or behavior. Real intake records show the data impact, demands and recovery conditions in individual systems. These layers complement each other but do not replace one another.

Interpretations of attacker pricing, relationships between samples and potentially intact data remain hypotheses requiring verification. This article gives no general recovery rate without corresponding extraction and acceptance results.

03 / CAUTIOUS ATTRIBUTION

Why use PIZ-2026 / Pizhon-tracked?

TEKLab uses PIZ-2026 / Pizhon-tracked as a working identifier: “PIZ-2026” describes the cases being tracked; “Pizhon-tracked” records a CTI source’s classification. It does not assert shared source code, operators or cryptographic implementation across all samples.

The original research also noted inconsistent labels on aggregation sites, including “Rainbird” and attribution to STOP/Djvu. TUNGTEK does not adopt those labels as technical conclusions without sufficient sample analysis.

Pizhon from 2020 does not automatically represent .PIZ in 2026

Antiy described Pizhon in 2020 with extensions beginning with .pizhon, a note titled !!!README!!!.txt in Russian and distribution by email. That historical context differs from the .piz indicators, English notes and contact details in the current records. [2]

04 / TUNGTEK CASE STUDIES

8 .PIZ tickets: from incident to verifiable data

The records cover business systems, Windows Server / file servers, SQL databases, ERP/FAST, backups and operational data. The problem goes beyond identifying malware: businesses need to know which data may still be usable and what to assess first to restore operations.

The article on the initial 3 cases records observations as of 23 September 2026. This analysis expands the scope to eight tickets; sample-specific assessment results from the earlier article are not converted into a success rate for the entire dataset.

TUNGTEK publishes only the aggregate details needed for analysis. Customer names, full victim IDs, internal paths and database contents remain outside the article.

05 / RANSOM DEMAND

What do demands of USD 2,000–12,000 tell us?

Demands across the eight tickets were not fixed. TUNGTEK recorded amounts of USD 2,000, 3,000, 4,000 and 5,000. In particular, one system with four machines received individual demands of USD 6,000, 8,000, 10,000 and 12,000.

This suggests attackers may price by host, system role, data type, importance or ability to pay. This remains an operational hypothesis, with insufficient evidence for a fixed pricing rule or complete economic model.

Whether the demand is USD 2,000 or USD 12,000, businesses still need technical answers: are backups clean, do attackers retain access, how extensive is compromise, are there signs of data theft, is encryption full or partial, and are recovery options independent of the attacker available?

06 / TEKLab ANALYSIS

High entropy is an indicator, rather than a conclusion

Entropy reflects unpredictability in byte distribution. In examined .PIZ samples, TEKLab observed high entropy in affected data regions. This is consistent with transformed or encrypted data, but does not by itself prove the transformation mechanism.

ZIP, 7z, JPEG, MP4, compressed backups and legitimately encrypted data can also have high entropy. A single whole-file value can conceal differences between intact and affected regions.

RFC therefore examines regions and structure

• Analyze entropy by block and compare the beginning, middle and end of the file.
• Compare original and affected files where a suitable pair exists.
• Check magic bytes, headers, footers, size and format structure.
• Identify transformation patterns, intact blocks and prospects for reconstructing data relationships.
• For databases, examine pages and consistency, then check whether extracted results can be opened, read and used.

07 / TTP & FORENSICS

RDP, databases and remote-control software

360’s June 2026 report associates the keyword piz with RDP brute force or database brute force; after login, attackers install remote-control software to deploy malware. The source also describes self-deletion code in the encryptor. [1]

These are avenues for investigation, rather than confirmed intrusion paths for all 8 TUNGTEK tickets. Legitimate remote-control software may be abused after compromise; its presence alone does not establish the incident’s cause.

Even without the encryptor, reconstruct the timeline

Self-deletion means that failure to find the malware after an incident does not prove it never existed. Where evidence permits, TEKLab compares $MFT, $UsnJrnl:$J, Prefetch, Amcache, Shimcache, Windows Event Logs, Terminal Services logs, Defender/AV history, SRUM, remote application history and related timestamps.

The goal is to examine initial access, remote control, privilege/execution, encryption and potential self-deletion. Each link requires its own evidence; a single artifact may be missing, overwritten or open to several interpretations.

08 / TOOL STATUS

No trustworthy public decryptor confirmed

As of the editorial date of 26 September 2026, TUNGTEK had not confirmed an independent, trustworthy public decryptor specifically for PIZ-2026. A check of No More Ransom’s Decryption Tools catalog at that time found no .PIZ / Pizhon entry. This defines the scope of the check, rather than proving that no tool exists anywhere. [4]

Be cautious with sites advertising a “PIZ decryptor” without publishing sample scope, cryptographic analysis or verifiable key provenance. Do not run unknown executables on original data or recently attacked servers. A tool named after the extension may still be incompatible with the sample being handled.

The absence of a confirmed decryptor does not establish that every recovery route is exhausted. Clean backups, surviving copies, unaffected regions and structural reconstruction can be assessed only after examining the current state. For data securely encrypted with no alternative source, these methods should not be promised as a solution.

09 / RFC & RANSOMWARE RECOVERY

Preserve data first, assess extraction prospects next

A common post-ransomware mistake is to format drives, reinstall Windows, initialize disks, rebuild RAID or restore over old volumes because files no longer open. These actions can destroy surviving usable data and evidence. Where conditions permit, TUNGTEK prioritizes a byte-for-byte image/clone before actions that may change the original data.

An affected file such as .MDF.PIZ, .BAK.PIZ, .VHDX.PIZ or datastore must be examined for altered regions, surviving content and reconstruction prospects. Renaming a file or observing its full size cannot answer these questions.

What does RFC — Ransomware Fast Check examine?

1. How much has the data changed? Examine representative samples, block-level entropy, matching original/affected pairs, header/footer structure and impact patterns.
2. What data sources remain available? Review intact blocks, database pages, fragmentation, copies, backups and deleted data where recovery conditions permit.
3. Can the logical structure be reconstructed? Test suitable copies, assess relationships between data components and document limitations for each file type.
4. Are the extracted results usable? Verify content in the relevant application against agreed operational criteria; an exported file does not necessarily contain usable data.

RFC is not a decryptor. It is a technical assessment to help businesses understand their options before choosing a Ransomware Recovery. Scope, costs and acceptance conditions follow the findings, rather than a general promised success rate.

When .PIZ is first discovered

• Isolate systems from Internet/LAN as appropriate to the incident; consider preserving volatile evidence before power-related actions.
• Avoid formatting, reinstalling, initializing disks, rebuilding RAID or restoring over original data before assessment.
• Preserve ransom notes, victim IDs, logs, file samples and timestamps; record related drives, VMs and backups.
• Identify servers, NAS, workstations, databases, backups and privileged accounts within the incident scope; examine RDP, databases and remote applications.
• Prioritize operational data; where possible, test recovery on images/copies and verify backup cleanliness before restoration.

NIST IR 8374 Rev. 1 (2026) places ransomware within the cycle Govern – Identify – Protect – Detect – Respond – Recover. This view connects recovery with response and risk management, extending beyond the question of buying a key. [3]

See also the CuuDuLieuMaHoa.com RFC process and the NAS .encrypt ransomware case for preservation and verification of extracted data.

10 / TEKLab CONCLUSION

Decisions based on samples, structure and usable data

.PIZ is a set of cases worth tracking in 2026. Public CTI links the keyword to Pizhon, but attribution and the cryptographic implementation of current samples still require verification. PIZ-2026 / Pizhon-tracked reflects that level of caution.

As of 25 September 2026, TUNGTEK had recorded 8 tickets, with ransom demands of USD 2,000–5,000 and one four-machine system with demands of USD 6,000 / 8,000 / 10,000 / 12,000. The dataset is insufficient to infer a pricing rule or a recovery result for a new case.

High entropy in affected regions is one part of TEKLab’s analysis. RFC’s practical value is in assessing transformation, remaining sources, reconstruction prospects and extracted data quality. Final conclusions must relate to usable data, rather than a ransomware name or demanded amount.

Further monitoring should cover samples/hashes, IOCs, ransom notes, related infrastructure, TTPs, cryptographic behavior, demands and recovery tools. As evidence develops, each assessment should be updated within the scope that evidence supports.