Threat Intelligence Report October 21 - October 27 2025

Tengu Ransomware Overview

Tengu is a new RaaS operation first observed in October 2025. Tengu executed hands-on intrusions with double-extortion: data is exfiltrated before encryption; victims are directed to Tor portals for negotiation; and leak listings follow if payment stalls. Expect valid-account abuse, lateral movement, shadow-copy deletion, log tampering, and living-off-the-land execution.

Detailed TTPs

Initial Access

• Valid accounts / exposed remote services (RDP/VPN): Operator-driven intrusion leveraging stolen creds and remote access surfaces (ATT&CK: T1078, T1133).
• Public-facing app exploitation & targeted phishing (likely): Consistent with early-stage footholds seen in comparable RaaS ops (ATT&CK: T1190, T1566).
  
  

Execution

• LOLBins & script interpreters: powershell.exe, cmd.exe, rundll32.exe for proxy execution (ATT&CK: T1059, T1218).
• Operator tooling launch: Generic PE dropper then encryption module on endpoints (Windows), observed sample size ~534KB (likely .NET).
  
  

Privilege Escalation & Credential Access

• LSASS dumping/credential theft: Standard RaaS tradecraft during staging
  
  

Defence Evasion

• Service tamper & AV/EDR weakening:
  sc config wscsvc start= disabled
  sc config wuauserv start= disabled (ATT&CK: T1562).
• Log clearance: wevtutil cl *
• Living-off-the-land execution: rundll32, PowerShell to blend with admin activity (ATT&CK: T1218, T1059).
  
  

Discovery

• Network/service discovery & share enumeration to scope blast radius
  
  

Collection & Exfiltration (Double-Extortion)

• Staging + compression then bulk exfiltration using Rclone / WinSCP / cloud storage (e.g., MEGA) over encrypted channels (ATT&CK: T1074, T1041, T1567).
  
  

Host Artifacts (Correlated to TTPs)

• Dropped in C:\Windows\System32\:
  wraithnet_bot.exe, controller_gui.exe, controller_console.exe, wraithnet.log — used by/alongside the encryptor; good pivot points for hunts.
  
  

Ransom Note Workflow

• README-style note prefixed with [ TENGU ] and a Ticket ID; directs to live chat on onion site; explicitly states data exfiltration prior to encryption and threatens leaks/key destruction if non-payment (indicator of double-extortion stage completed).

MITRE ATT&CK Mapping

Indicators of Compromise (IOCs)

Malware Samples

• SHA-256: FAFB6C5E12DFEEFABA5AC8982D5BB13DD206CFCD328B9D36AA87257F762EE24A
• MD5: DFBC9412BE99B25137AB6AB575489A93
  
  

File/Note Artifacts

Encrypted extension:  .tengu.

Ransom note filenames: TENGU_README.txt or <ID>-README.txt (e.g., 8F2Z-README.txt);

Tor Infrastructure

fuvodyoktsjdwu3mrbbrmdsmtblkxau6l7r5dygfwgzhf36mabjtcjad.onion

longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onion

Anti-Recovery / Cleanup Commands

• vssadmin delete shadows /all /quiet (shadow copy deletion)
• wevtutil cl <LogName> (log clear)
• sc config wscsvc start= disabled and sc config wuauserv start= disabled (disable Security Center/Windows Update)
  
  

CE 5.5 Mitigations

• Eliminate WAN exposure to RDP/WinRM/SMB/admin UI and enforce MFA on VPN and all admin access.
• Block Tor (exits/bridges) and common exfil paths (MEGA/Dropbox/Syncthing) at CE firewall/DNS; Surge: disable QUIC and drop rclone/WinSCP traffic.
• Hard segment networks; deny East-West SMB/WMI/WinRM except via a jump-box; block PsExec/NTLM lateral movement.
• CE IDS baseline: Security=Alert; Surge: Alert+Drop for Tor/rclone/cloud SNI/JA3 and high-confidence mass-rename/encryption patterns.
• Ingest Sysmon + Windows logs into CE SIEM and auto-isolate hosts on hits for vssadmin, wevtutil, and Run-key persistence.
• Keep backups offline/immutable, block backup VLAN outbound to Internet, and verify restores on a fixed schedule.

Ransomware Victims Worldwide

The United States continued to dominate ransomware targeting, representing 57.32% of reported victims this week. This overwhelming concentration reinforces its position as the most attractive target for adversaries, driven by its expansive digital infrastructure, critical industries, and financial pressure points.

Canada (6.37%) and Australia (5.73%) followed as the most impacted outside the U.S., reflecting consistent targeting of Anglosphere economies. The United Kingdom (3.18%) also ranked prominently, highlighting the ongoing focus on European financial and service sectors.

Mid-tier victimisation was observed in Spain (1.91%), Singapore (1.91%), India (1.91%), and Qatar (1.91%), with Egypt, Saudi Arabia, Switzerland, Germany, Thailand, Brazil, and Japan each reporting 1.27%. These figures demonstrate ransomware’s steady expansion across Europe, Asia, and the Middle East, targeting a mix of developed economies and emerging digital hubs.

A long tail of isolated incidents (0.64% each) spanned Peru, Dominican Republic, South Africa, Madagascar, Gabon, Finland, Mexico, Czech Republic, El Salvador, Indonesia, United Arab Emirates, France, Honduras, South Korea, China, Morocco, and Slovakia. While individually small, these cases illustrate ransomware’s truly global footprint, impacting countries across every continent.