Vietnam case studies
Ticket #1355: what is known and unknown about a NAS case
Read TUNGTEK's public NAS record through its evidence: received devices, attribution limits and missing data.
Tùng TEKNot independently verifiedCase Studies
Case records approved for publication, protecting client identities and stating what remains unknown.
Only published information is shown. Results from a sample are not extrapolated to an entire system.
Vietnam case studies
Ransomware .PIZ 2026: comparing eight cases recorded by TUNGTEK
Eight internal tickets: ransom demands, indicators, reference TTPs and attribution limits. The .PIZ extension does not establish a family.
No.Ransomware.VNNot independently verifiedPreserve the original state
Why stopping writes, retaining logs and making working copies can change the outcome.
Identify multiple layers of encryption
A file extension or ransom note alone is insufficient to establish the family and incident scope.
Defensive lessons
Turn investigation findings into technical controls and procedures.
Threat IntelligenceRansomware Recovery