tengu

Executive Summary

Tengu is a recently emerged Ransomware-as-a-Service (RaaS) operation utilizing a double-extortion model and Living Off The Land Binaries (LOLBins). Targeting multiple sectors including consumer goods and healthcare, Tengu poses a significant risk to organizations due to its sophisticated tactics and rapid campaign activity.

Goals & Targeting

Tengu's primary goals are financial gain via ransoms and reputational damage through data leaks. The targeting of sectors with high data sensitivity indicates an intent to maximize both ransom demands and the impact of leaked information, affecting a diverse range of industries and potentially global operations.

Tengu emerged in October 2025 as a RaaS operator employing a double-extortion ransomware model. This approach combines data encryption with threats of leakages, enhancing the pressure on victims to comply. The use of LOLBins allows Tengu's activities to mimic legitimate administrative tasks, making detection challenging. Targeting sectors such as healthcare and real estate suggests an emphasis on industries holding sensitive or valuable data. Despite being a medium-sophistication threat actor, Tengu demonstrates effective operational methods through its campaigns.

Key Capabilities

• Ransomware-as-a-Service (RaaS) operation
• Double extortion tactics
• Use of Living Off The Land Binaries (LOLBins)
• Persistence and lateral movement techniques

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Tengu has executed campaigns against diverse targets, including Sileno Companies Inc and Eos Technology srl. With 49 recorded victims, Tengu demonstrates an aggressive approach likely facilitated by affiliates or partners. The group's operational tempo is brisk, with activity tracked from October 2025 to March 2026, indicating both persistence and adaptability.

IOC Patterns

• Use of legitimate binaries for malicious activities
• Spear-phishing emails preceding infection vectors
• Lateral movement using system administrative tools

Recommended Actions

• Implement robust endpoint detection solutions
• Regularly back up systems and secure backups offline
• Monitor for unusual admin tool activity
• Educate users on phishing awareness
• Maintain updated security protocols and patches

Suggested Tags