tengu Ransomware
Also known as: Shisa · Tracked since Oct 23, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Tengu is a RaaS operation first observed in October 2025, following a double-extortion model and using Living Off The Land Binaries (LOLBins) to blend malicious activity with normal admin traffic, primarily targeting consumer goods, real estate, automotive, healthcare, and IT sectors.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid Accounts Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command Shell Persistence
T1053.005 Scheduled Task/Job: Scheduled Task Defense Evasion
T1070 Indicator RemovalT1218 System Binary Proxy Execution Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol Exfiltration
T1041 Exfiltration Over C2 Channel Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live