Ransomware needs a way in. Stolen credentials are the cheapest one.
toufan Ransomware Group
Ransomware group profile
Description
Toufan is a ransomware group known for its targeted attacks, utilizing advanced techniques to encrypt data and demand ransoms. With a reputation for quickly adapting their tactics, they often employ phishing and exploits to infiltrate networks. Their recent focus includes critical infrastructure and high-value sectors, posing significant risks to their targets.
Key insights
- •Employs a mix of phishing, exploits, and insider threats for initial access.
- •Targets critical sectors such as healthcare, finance, and government.
- •Utilizes double extortion tactics, threatening to leak sensitive information.
- •Frequently updates malware and attack methodologies based on vulnerabilities.
- •Notable for targeting high-profile individuals to leverage psychological impacts.
Threat Level & Status Breakdown
For toufan · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for toufan in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for toufan
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for toufan
T1486
T1486
T1490
T1490
T1040
T1040
T1078
T1078
T1059
T1059
T1562
T1562
T1021
T1021
T1135
T1135
T1563
T1563
T1543
T1543
T1069
T1069
T1203
T1203
Victims(36)
Page 1 of 2
Affected countries(12)
Countries where this group has been reported to target or leak victims.