toufan
Ransomware group profile
Description
Toufan is a ransomware group known for its targeted attacks, utilizing advanced techniques to encrypt data and demand ransoms. With a reputation for quickly adapting their tactics, they often employ phishing and exploits to infiltrate networks. Their recent focus includes critical infrastructure and high-value sectors, posing significant risks to their targets.
Key insights
- •Employs a mix of phishing, exploits, and insider threats for initial access.
- •Targets critical sectors such as healthcare, finance, and government.
- •Utilizes double extortion tactics, threatening to leak sensitive information.
- •Frequently updates malware and attack methodologies based on vulnerabilities.
- •Notable for targeting high-profile individuals to leverage psychological impacts.
Threat Level & Status Breakdown
For toufan · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for toufan in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for toufan
- d520d06d78afcad2e03842cb8db4622d18b92739e89dfb8dadf5743f30dcd903
- e75e5778e71e062ce4a7af673f0b2513854d2367fee0f01a26c0c998863bdf6e
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for toufan
T1486
T1486
T1490
T1490
T1040
T1040
T1078
T1078
T1059
T1059
T1562
T1562
T1021
T1021
T1135
T1135
T1563
T1563
T1543
T1543
T1069
T1069
T1203
T1203
Victims(36)
Page 1 of 2
Affected countries(7)
Countries where this group has been reported to target or leak victims.