tengu Ransomware Group

Key insights

• •Initial access typically involves exploiting exposed remote services and valid-account abuse.
• •Tengu utilizes a variety of tools including living-off-the-land binaries and custom utilities for data exfiltration.
• •Their extortion model emphasizes double extortion, with encrypted files tagged with a .tengu extension and threats of data leaks.
• •Tengu employs tactics for defense evasion such as disabling Microsoft Defender and clearing event logs.
• •They leverage Tor-based negotiation portals to communicate with victims during ransom negotiations.