Tengu Ransomware: Attack Chain From Initial Access to Encryption

Overview

Tengu is a Ransomware-as-a-Service (RaaS) operation that relies on a double-extortion model. The threat actors steal sensitive information prior to encryption and use a Tor browser-based portal to negotiate with victims. Rather than deploying custom malware, Tengu operators heavily utilize Living Off The Land Binaries (LOLBins) to execute payloads, allowing their malicious activities to blend in with normal administrative traffic.

Associated Malware or Tools

• LOLBins: powershell.exe, cmd.exe, rundll32.exe, vssadmin, wevtutil, and sc
• Exfiltration Tools: Rclone and WinSCP
• Exfiltration Destination: MEGA cloud storage

Techniques and TTPs (Mitre ATT&CK Mapping)

• T1566.002 Phishing: Spearphishing Link
• T1190 Exploit Public-Facing Application
• T1078 Valid Accounts
• T1059.001 Command and Scripting Interpreter: PowerShell
• T1059.003 Command and Scripting Interpreter: Windows Command Shell
• T1218.011 System Binary Proxy Execution: Rundll32
• T1003.001 OS Credential Dumping: LSASS Memory
• T1562.001 Impair Defenses: Disable or Modify Tools
• T1070.001 Indicator Removal: Clear Windows Event Logs
• T1567.002 Exfiltration to Cloud Storage
• T1490 Inhibit System Recovery
• T1486 Data Encrypted for Impact

Key Takeaways

• Tengu is a Ransomware-as-a-Service (RaaS) operation first observed in October 2025, using a double-extortion model.
• Tengu operators rely on living-off-the-land binaries (LOLBins) such as PowerShell, cmd.exe, and rundll32.exe to execute payloads, blending malicious activity into normal administrative traffic.
• Tengu prioritizes organizations in Morocco, Iran, the UAE, Spain, and Brazil rather than heavily defended North American or Western European targets.
• Data exfiltration uses trusted tools like Rclone and WinSCP, with MEGA cloud storage as the destination. Shadow copies are deleted with vssadmin before the ransomware payload runs, appending the .tengu extension to encrypted files.
• Picus Threat Library includes a dedicated simulation for Tengu ransomware (Threat ID: 25863, Windows Endpoint module), allowing security teams to test their defenses against this threat and get actionable mitigation insights.

Tengu is a Ransomware-as-a-Service (RaaS) operation first observed in October 2025. It follows a double extortion model, where the attackers steal sensitive information prior to encryption and then use a portal based on the Tor browser to negotiate with the victim.

Tengu ransomware uses a technique called Living Off The Land Binaries (LOLBins), where attackers use trusted, signed Microsoft binaries like PowerShell, cmd.exe, and rundll32.exe to execute the ransomware payload.

The ransomware targets specific countries instead of focusing on highly secured targets in North America or Western Europe. Tengu focuses on Morocco, Iran, the UAE, Spain, and Brazil [1].

In this blog, we'll discuss the technical details of Tengu ransomware attacks and how Picus can help you protect your organization from Tengu ransomware attacks.

How Does Tengu Ransomware Work?

Initial Access

Operators gain entry through two primary methods [2].

The first is credential abuse against exposed remote services. Tengu operators use stolen credentials to log into RDP or VPN endpoints. From the network's perspective, this looks like a legitimate employee login.

The second is exploitation and phishing. Operators target unpatched public-facing applications or send targeted phishing emails to establish a foothold.

Execution and Lateral Movement

Once inside, operators avoid custom malware wherever possible. They rely on LOLBins to execute payloads and blend their activity with routine administrative work.

Tools used at this stage:

• powershell.exe: Runs malicious commands and scripts
• cmd.exe: Executes commands via the Windows Command Shell
• rundll32.exe: Proxies execution of malicious payloads in memory, making them appear as normal system activity

Simultaneously, the operator dumps LSASS memory to harvest credentials. The LSASS process holds authentication materials for logged-on users, including domain administrator credentials. Obtaining those credentials gives the operator a chance for lateral movement across the network.

Disabling Security Controls

Tengu operators actively blind endpoint security before moving further. The following commands are executed directly [2]:

To destroy forensic evidence, the operator runs:

Data Exfiltration for Double Extortion

The operator stages and compresses collected data locally before exfiltration. Then the data was sent. MEGA cloud storage was used as the destination of the data.

For bulk exfiltration, operators use legitimate, trusted tools [3]:

• Rclone: An open-source command-line tool.

The following is a conceptual command, which uploads the exfiltrated data to Mega:

• WinSCP: A legitimate file transfer client.

Encryption

With data secured, the operator removes the victim's ability to restore systems without paying.

Shadow copies are deleted with:

The ransomware payload then executes, encrypting files across the network. Each encrypted file receives the .tengu extension.

The operator drops a ransom note using one of the following filenames:

Below is a part of an example ransom note used by Tengu ransomware [3]:

How Picus Simulates Tengu Ransomware Attacks?

We also strongly suggest simulating Tengu ransomware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other ransomware variants, such as Warlock, BlackCat, Black Basta, and Akira, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Tengu Ransomware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.

References

[1] J. Mousqueton, “Group: tengu,” Ransomware.live. Accessed: Mar. 27, 2026. [Online]. Available: http://www.ransomware.live/group/tengu

[2] J. Shenouda, “New Threat Actor: Tengu - Joe Shenouda,” Joe Shenouda | Threat Intelligence. Accessed: Mar. 27, 2026. [Online]. Available: https://www.shenouda.nl/new-threat-actor-tengu/

[3] “Threat Intelligence Report October 21st to October 27th, 2025.” Accessed: Mar. 27, 2026. [Online]. Available: https://www.redpiranha.net/news/threat-intelligence-report-october-21-october-27-2025