#threatreport #HighCompleteness
Dark Web Profile: Tengu Ransomware (Shisa) | 14-06-2026
Source:
socradar.io/blog/dark-web-pr…
Key details below ↓
💀Threats:
Tengu_ransomware, Stealtengu_tool, Stealtg_tool, Rclone_tool, Edr-killer, Salatstealer, Residential_proxy_technique, Spear-phishing_technique, Fortirdp_tool, Shadow_copies_delete_technique, Zerologon_vuln, Netexec_tool, Wevtutil_tool, Lolbin_technique, Screenconnect_tool, Credential_dumping_technique, Password_spray_technique,
🎯Victims: Technology, Manufacturing, Construction and real estate, Automotive, Hospital sector, Agriculture and food production
🏭Industry: Transport, Entertainment, Foodtech
🌐Geo: India, Japanese, Indonesia, Morocco, Iranian, Brazil, Iran, Middle east, Asia, Spain, Russia, African, Mexico, Poland, Africa, Qatar, Italy, United states, America, Thailand
🔓CVEs: CVE-2020-1472 \[[Vulners](
vulners.com/cve/CVE-2020-147…)]
- CVSS V3.1: *10.0*,
- Vulners: Exploitation: True
Soft:
- microsoft windows_server_1903 (*)
- microsoft windows_server_1909 (*)
- microsoft windows_server_2004 (-)
- microsoft windows_server_2008 (r2)
...
📚TTPs:
⚔️Tactics: 13
🛠️Technics: 26
🧨IOCs:
- File: 13
- Hash: 1
- Email: 1
- IP: 8
💽Software: Linux, ESXi, WinSCP, PixelDrain, Active Directory, Windows Defender, Windows Security Center, Windows Update service, wuauserv
🔢Algorithms: sha256
🗂️Win API: README
⚙️Win Services: wscsvc, wuauserv
📜Programming Languages: powershell
#threatreport:
Tengu Ransomware, which rebranded to Shisa Ransomware in March 2026, is a financially motivated Ransomware-as-a-Service (RaaS) organization first identified in late 2025. This group utilizes a double-extortion strategy by stealing sensitive data and encrypting system files, thereby pressuring victims to comply with ransom demands. Tengu notably targets organizations across a wide geographical range, initially focusing on the Middle East and North Africa, and then expanding to include victims in North America, Europe, and Asia.
The RaaS program operates on a structured model, featuring an 80/20 revenue split favoring affiliates, utilizing encrypted communication via TOX, and offering builds compatible with Windows, Linux, and ESXi systems. Their malware operates through an intermittent encryption technique which targets file headers, allowing for rapid encryption of large datasets. A notable incident involved the encryption of 22.9TB of data in just 14 hours, showcasing their efficiency.
For data exfiltration, Tengu employs custom tools such as StealTENGU and StealTG, along with general-purpose applications like Rclone and WinSCP. Additionally, they make use of MEGA for primary storage and various other services for secondary usage. The threat actors have designed their operational framework to maintain a low profile, leveraging common tools and methods to mimic legitimate activities, thus complicating detection efforts.
Tengu’s initial access methods largely revolve around credential exploitation, conducting brute-force attacks against poorly secured RDP and SMB interfaces, and spear phishing campaigns. They also leverage known vulnerabilities such as ZeroLogon (CVE-2020-1472) for privilege escalation. Following this, they perform lateral movement within compromised networks using tools like NetExec over SMB and RDP, blending their activities with normal administrative traffic.
An essential aspect of Tengu's methodology includes defense evasion tactics where they disable security measures such as Windows Defender and clear event logs to avoid detection prior to executing their ransomware payload. This strategy ensures that data exfiltration occurs undetected before initiating full system encryption, with affected files marked with the .tengu extension.
To mitigate threats from Tengu Ransomware, organizations are advised to implement multi-factor authentication for remote access services, patch known vulnerabilities, and enhance monitoring for irregular authentication attempts. Security teams should also track Tengu-related infrastructure and shared indicators in threat intelligence databases, alerting on unusual tool usage patterns indicative of ransomware activity. By focusing on these areas, organizations can better defend against this emerging threat.