SOCRadar Profiles Tengu Ransomware’s Attack Chain and Shisa Rebrand
Summary
SOCRadar profiles Tengu, a RaaS operation that claimed about 50 victims before rebranding as Shisa in March 2026. It details credential-based access, LOLBins, ZeroLogon exploitation, data theft before intermittent encryption, infrastructure, and defenses.
Key points
- Tengu first appeared in October 2025 and claimed approximately 50 victims before its leak site rebranded as Shisa in March 2026.
- The group used double extortion, stealing data before encryption and threatening to publish it; the article describes intermittent encryption and Windows, Linux, and ESXi builds.
- Reported access methods include brute-forcing exposed RDP and SMB, spearphishing, public-facing application exploitation, and reused credentials.
- The article describes LSASS dumping, NetExec over SMB, and use of legitimate Windows binaries to execute commands and disable defenses. It reports one confirmed case of ZeroLogon exploitation (CVE-2020-1472).
- Reported exfiltration tools include StealTENGU and StealTG, with MEGA described as the primary storage destination.
- SOCRadar reports that researcher analysis identified exposed infrastructure, including the real IP behind a Tor service and IPs used in brute-force activity.
- Suggested defenses include MFA on remote-access interfaces, monitoring for credential dumping and unusual LOLBin activity, egress controls, and offline or immutable backups.
Article Details
- Attack Vectors
- Affiliates brute-forced exposed RDP and SMB services, using residential proxies and commercial VPS infrastructure.
- Other reported initial-access methods included spearphishing links, exploitation of public-facing applications, and reuse of credentials from prior data breaches.
- In at least one confirmed case, affiliates exploited CVE-2020-1472 against an unpatched domain controller to obtain domain administrator privileges.
- After access, affiliates used LSASS dumping, NetExec over SMB, and RDP for credential access and lateral movement.
- The operation collected data from network shares and local systems, then exfiltrated it before deploying ransomware.
- The ransomware used intermittent encryption; affiliates deleted shadow copies and disabled security services before encryption.
- Defensive Notes
- Enforce MFA on RDP, VPN, and remote-management interfaces; block or segment exposed remote services and alert on repeated SMB and RDP authentication failures.
- Prioritize patching internet-facing remote-access services and unpatched domain controllers, including systems vulnerable to CVE-2020-1472.
- Monitor for LSASS access and memory dumping, unauthorized deployment of remote-access tools, and unusual execution of PowerShell, cmd.exe, rundll32.exe, wevtutil.exe, vssadmin.exe, and sc.exe.
- Monitor unexpected Rclone or WinSCP use, bulk file access, and large outbound transfers; apply egress controls for unauthorized cloud-storage connections.
- Maintain offline or immutable backups and alert on shadow-copy deletion activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
tengulocker@cyberfear[.]com | Victim contact address used by the Tengu ransomware group. | |
tengunlocker@onionmail[.]com | Victim contact address used by the Tengu ransomware group. | |
| IPV4 | 110[.]227[.]205[.]232 | Listed as high-confidence Tengu attack infrastructure. |
| IPV4 | 117[.]239[.]53[.]213 | Listed as a residential proxy used in Tengu-associated operations and geolocated to India. |
| IPV4 | 117[.]240[.]9[.]147 | Listed as a residential proxy used in Tengu-associated operations and geolocated to India. |
| IPV4 | 117[.]244[.]244[.]52 | Listed as a residential proxy used in Tengu-associated operations and geolocated to India. |
| IPV4 | 123[.]255[.]248[.]97 | Listed as high-confidence Tengu attack infrastructure. |
| IPV4 | 206[.]168[.]81[.]33 | Listed as high-confidence Tengu attack infrastructure. |
| IPV4 | 61[.]0[.]226[.]126 | Listed as high-confidence Tengu attack infrastructure. |
| IPV4 | 94[.]26[.]88[.]100 | Listed as part of MEVSPACE VPS infrastructure associated with Tengu; the article identifies this infrastructure as Poland-based. |
| SHA256 | fafb6c5e12dfeefaba5ac8982d5bb13dd206cfcd328b9d36aa87257f762ee24a | SHA-256 of an unsigned .NET executable described as a Windows Defender disabler linked to Tengu activity; public threat-intelligence databases also tagged it as SalatStealer. |
MITRE ATT&CK
T1003.001 · LSASS MemoryAffiliates dumped LSASS memory to extract credentials in cleartext.T1021.001 · Remote Desktop ProtocolRDP was used for interactive access to high-value targets.T1021.002 · SMB/Windows Admin SharesAffiliates used NetExec over SMB to execute commands across multiple systems.T1059.001 · PowerShellAffiliates used powershell.exe for script execution and payload delivery.T1059.003 · Windows Command ShellAffiliates used cmd.exe for command execution and environment enumeration.T1068 · Exploitation for Privilege EscalationIn at least one confirmed case, affiliates exploited CVE-2020-1472 on an unpatched domain controller to obtain domain administrator privileges.T1070.001 · Clear Windows Event LogsAffiliates cleared event logs using wevtutil before encryption.T1078 · Valid AccountsAffiliates reused valid credentials from prior data breaches for initial access.T1110.001 · Password GuessingAffiliates brute-forced exposed RDP and SMB interfaces.T1218.011 · Rundll32rundll32.exe was used for DLL-based payload execution and defense evasion.T1486 · Data Encrypted for ImpactThe ransomware used intermittent encryption, and encrypted files received the .tengu extension.T1490 · Inhibit System RecoveryAffiliates deleted shadow copies immediately before ransomware execution.T1562.001 · Disable or Modify ToolsAn unsigned .NET executable was used to disable Windows Defender, and security-related services were stopped.T1566.002 · Spearphishing LinkThe article reports spearphishing links as an initial-access method.T1567.002 · Exfiltration to Cloud StorageData was exfiltrated before encryption, primarily to MEGA, with PixelDrain and StorJ listed as secondary destinations.
CVE
Threat Actors
Shisa RansomwareThe article identifies Shisa Ransomware as the March 2026 rebranding of the Tengu Ransomware operation and reports continued ransomware activity under the new name.Tengu RansomwareThe article describes Tengu as a financially motivated RaaS operation that used data theft, extortion, and encryption; it reports that the operation rebranded as Shisa Ransomware in March 2026.
Malware
SalatStealerOne technical indicator stands out: an initial dropper hash linked to Tengu activity was tagged as “SalatStealer” in public threat intelligence databases, while sandbox analysis showed ransomware-like behavior.Shisa RansomwareTengu Ransomware emerged as a disciplined RaaS operation that used double extortion, custom tooling, and affiliate management to claim about 50 victims before rebranding as Shisa Ransomware in March 2026.Tengu RansomwareTengu Ransomware emerged as a disciplined RaaS operation that used double extortion, custom tooling, and affiliate management to claim about 50 victims before rebranding as Shisa Ransomware in March 2026.
Products
ESXiThe operation offered Windows, Linux, and ESXi builds, and used custom tools such as StealTENGU and StealTG for exfiltration.Fortinet FortiGateIn at least one documented case, attacker-controlled infrastructure was observed hosting FortiGate on the RDP port, with FortiRDP subsequently installed on the victim machine, suggesting deliberate mimicry of legitimateWindows Defender[T1562.001] Impair Defenses: Disable or Modify Tools – Defender and security tools were disabled to reduce detection (‘Windows Defender is disabled early in the intrusion’).
Tools
FortiRDP[T1219] Remote Access Software – The group mimicked or used remote management tooling to maintain access (‘FortiRDP subsequently installed on the victim machine’).NetExecIts activity spanned multiple regions and relied on Tor-based leak infrastructure, intermittent encryption, and tools such as StealTENGU, StealTG, and NetExec to steal data, disable defenses, and pressure victims to pay.RCloneAffiliates also use Rclone and WinSCP, with MEGA as the main storage destination and SFTP, PixelDrain, and StorJ as secondary options.StealTENGUIts activity spanned multiple regions and relied on Tor-based leak infrastructure, intermittent encryption, and tools such as StealTENGU, StealTG, and NetExec to steal data, disable defenses, and pressure victims to pay.StealTGIts activity spanned multiple regions and relied on Tor-based leak infrastructure, intermittent encryption, and tools such as StealTENGU, StealTG, and NetExec to steal data, disable defenses, and pressure victims to pay.WinSCPAffiliates also use Rclone and WinSCP, with MEGA as the main storage destination and SFTP, PixelDrain, and StorJ as secondary options.
Countries
BrazilThe group’s early targeting of Middle Eastern and North African organizations, alongside Spain and Brazil, led analysts to assess that at least one affiliate or core member may be based in the Middle East.IndiaBy January 2026, the victim geography had broadened significantly to include North America, India, Europe, Southeast Asia, and beyond, reflecting typical RaaS expansion as the affiliate base diversified.IndonesiaItaly, Mexico, and Indonesia each represented 6.4%, suggesting that affiliates likely acquired access opportunistically rather than following strict geographic targeting rules.ItalyItaly, Mexico, and Indonesia each represented 6.4%, suggesting that affiliates likely acquired access opportunistically rather than following strict geographic targeting rules.MexicoItaly, Mexico, and Indonesia each represented 6.4%, suggesting that affiliates likely acquired access opportunistically rather than following strict geographic targeting rules.MoroccoOctober 2025: Original DLS launched, listing six initial victims from Qatar, Morocco, UAE, Spain, and BrazilPolandas high-confidence, residential proxies geolocated to India, and MEVSPACE VPS infrastructure based in Poland, a provider with documented history in criminal network operations.QatarOctober 2025: Original DLS launched, listing six initial victims from Qatar, Morocco, UAE, Spain, and BrazilSpainThe group’s early targeting of Middle Eastern and North African organizations, alongside Spain and Brazil, led analysts to assess that at least one affiliate or core member may be based in the Middle East.ThailandJanuary to February 2026: Charoenchai Transformer Co., Ltd (Thailand, manufacturing) and a Japanese Buddhist temple (Jouju-in) among victims claimed, illustrating the indiscriminate nature of targetingUnited StatesIn a March 2026 attack, a U.S. victim claimed that 22.9TB of data was encrypted in just 14 hours, showing the practical speed advantage of this method.
Industries
Agriculture and Food ProductionConstruction and Real Estate, Automotive, Hospitality and Tourism, Public Sector, and Agriculture and Food Production also appeared among the leading sectors.AutomotiveConstruction and Real Estate, Automotive, Hospitality and Tourism, Public Sector, and Agriculture and Food Production also appeared among the leading sectors.construction and real estateConstruction and Real Estate, Automotive, Hospitality and Tourism, Public Sector, and Agriculture and Food Production also appeared among the leading sectors.Hospitality and TourismConstruction and Real Estate, Automotive, Hospitality and Tourism, Public Sector, and Agriculture and Food Production also appeared among the leading sectors.ManufacturingObserved victims spanned many regions and sectors, with Technology and Manufacturing among the most affected industries.Public SectorConstruction and Real Estate, Automotive, Hospitality and Tourism, Public Sector, and Agriculture and Food Production also appeared among the leading sectors.TechnologyObserved victims spanned many regions and sectors, with Technology and Manufacturing among the most affected industries.