Overview
Tengu is a RaaS operation first observed in October 2025, following a double-extortion model and using Living Off The Land Binaries (LOLBins) to blend malicious activity with normal admin traffic, primarily targeting consumer goods, real estate, automotive, healthcare, and IT sectors.
- First tracked: 2025-10-23
- Also known as: Shisa
- Discussed in our reports: Gulf summary · Maghreb · Saudi Arabia · Türkiye · UAE
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
India5
United States of America4
Morocco4
Italy3
Mexico3
Indonesia3
United Kingdom2
United Arab Emirates2
France2
Colombia2
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
| Initial Access | Execution | Persistence | Defense Evasion | Lateral Movement | Exfiltration | Impact |
|---|---|---|---|---|---|---|
| Valid Accounts | Command and Scripting Interpreter: PowerShell | Scheduled Task/Job: Scheduled Task | Indicator Removal | Remote Services: Remote Desktop Protocol | Exfiltration Over C2 Channel | Data Encrypted for Impact |
| Command and Scripting Interpreter: Windows Command Shell | System Binary Proxy Execution | Inhibit System Recovery |
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Abuse of valid accounts (obtained via infostealers or IABs).
Execution (TA0002)
- T1059.001 · Command and Scripting Interpreter: PowerShell: Intensive use of PowerShell for command and script execution.
- T1059.003 · Command and Scripting Interpreter: Windows Command Shell: Use of CMD for command execution.
Persistence (TA0003)
- T1053.005 · Scheduled Task/Job: Scheduled Task: Creation of Scheduled Tasks that run with SYSTEM privileges to ensure re-infection.
Defense Evasion (TA0005)
- T1070 · Indicator Removal: Cleaning of event logs.
- T1218 · System Binary Proxy Execution: Use of rundll32.exe for proxy execution.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: Lateral movement via RDP after compromising administrative credentials.
Exfiltration (TA0010)
- T1041 · Exfiltration Over C2 Channel: Data exfiltration via C2 channels before starting the encryption routine.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: File encryption.
- T1490 · Inhibit System Recovery: Deletion of Shadow Copies to prevent local recovery.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Shisa Ransomware Blog | DLS | longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11