Dark Web Profile: Tengu Ransomware (Shisa)
ID: 3aa8fc37-68aa-5009-b145-eb369e1c52eb
STIX ID: report--3aa8fc37-68aa-5009-b145-eb369e1c52eb
Feed Name: SOCRadar Blog
Threat Score
Tengu (aka Shisa) is a financially motivated Ransomware-as-a-Service operation first observed in Oct 2025 that uses a double‑extortion model, custom exfiltration tooling (StealTENGU/StealTG), intermittent encryption to rapidly encrypt large environments (22.9 TB in 14 hours reported), and a Tor-hosted data leak site; the report details victim geography (~50 victims across multiple continents), affiliate rules, technical TTPs, IOCs (hashes, filenames, IPs, contact addresses), and recommended mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.