Tengu Ransomware Emerges as Global Threat, Targeting 49 Organizations Across Multiple Industries

CyberDefender 12 mins0

As of early March 2026, monitoring of ransomware leak sites shows that the Tengu ransomware group has publicly claimed 49 victims. The affected organizations span several sectors, with the technology, manufacturing, agriculture and food production, and public sector industries appearing most frequently.

Geographically, the victims are distributed across multiple regions, including Morocco, India, the United States, Mexico, and Indonesia, among others.

The pattern that emerges from these incidents is clear: Tengu does not concentrate on a specific industry or geographic region. Instead, it appears to target organizations that share common weaknesses—particularly internet-exposed remote access services and poor credential management practices.

Operational Model: The Tengu Intrusion Lifecycle

Tengu operates using a double-extortion ransomware model combined with hands-on-keyboard activity. In this structure, affiliated operators perform the network intrusions, while a central development team manages the ransomware payload and the infrastructure used for extortion and negotiation.

Initial Access

Available reporting indicates that valid account abuse is the primary entry method for Tengu attacks. Affiliates typically exploit exposed remote access services, especially:

  • Remote Desktop Protocol (RDP)
  • VPN gateways

These services often lack multi-factor authentication (MFA), making them attractive targets when attackers obtain or guess valid credentials.

Other potential entry points—such as phishing campaigns or vulnerabilities in internet-facing applications—are considered possible but have not yet been directly linked to confirmed Tengu incidents through specific phishing templates or CVE exploits.

Execution and Defense Evasion

After gaining access to a system, Tengu operators rely heavily on living-off-the-land binaries (LOLBins)—legitimate tools already present in Windows environments.

The most common execution environments include:

  • PowerShell
  • Windows Command Prompt (cmd)

Several defensive bypass techniques have been observed, including:

  • Disabling Microsoft Defender through PowerShell using Set-MpPreference
  • Clearing Windows event logs with wevtutil cl
  • Modifying security service configurations via commands such as sc config ... start= disabled

Sandbox analysis of a publicly available malware sample linked to Tengu confirms that these techniques are actively implemented during attacks.

Persistence Mechanisms

To maintain long-term access to compromised systems, Tengu establishes persistence through several mechanisms.

One common method involves registry Run keys with distinctive names, such as:

  • SystemSecurityMonitor
  • WraithNet
  • WindowsSecurityUpdate

These registry entries typically point to executables located in temporary user directories.

In addition, operators create scheduled tasks using schtasks.exe to ensure malicious programs continue running even after system restarts.

Credential Access and Lateral Movement

Credential harvesting is another critical stage of Tengu’s attack chain. The group is known to dump the LSASS process, allowing attackers to extract authentication credentials from memory.

Once credentials are obtained, attackers can escalate privileges and move laterally across the network, often using compromised administrative accounts. While the exact tools used for LSASS dumping have not been fully documented in public reports, the tactic itself is consistent with standard ransomware operator tradecraft.

Data Exfiltration and Encryption

Tengu employs a double-extortion strategy, meaning that data is stolen before files are encrypted. The process generally unfolds in several steps:

  1. Sensitive data is collected and compressed.
  2. Files are transferred out of the network using tools such as Rclone and WinSCP over encrypted channels.
  3. Data is uploaded to cloud storage controlled by the attackers.

After exfiltration is complete, the attackers deploy the ransomware payload—described as a .NET-based encryptor—which appends the “.tengu” extension to affected files.

To prevent recovery, the attackers attempt to destroy system backups by executing:

vssadmin delete shadows /all /quiet

They also clear logs and leave behind ransom notes directing victims to Tor-based negotiation portals, where victims are threatened with public data leaks if payment is not made.

Key Indicators and Host Artifacts

Public reporting suggests that host-based artifacts are the most reliable detection points, as network indicators beyond Tor infrastructure are limited.

File System Artifacts

Several files associated with Tengu activity have been observed in:

C:\Windows\System32\

These include:

  • wraithnet_bot.exe
  • controller_gui.exe
  • controller_console.exe
  • wraithnet.log

Registry Persistence Keys

Persistence entries have been identified in registry Run paths such as:

  • HKLM\...\Run\SystemSecurityMonitor
  • HKCU\...\Run\WraithNet
  • HKCU\...\Run\WindowsSecurityUpdate

Each entry typically references executables located in temporary user directories.

Ransom Notes

Two variants of ransom messages have been documented:

  • TENGU.README.txt – branded as “TENGU Locker”
  • [random].README.txt – includes a unique Ticket ID assigned to each victim

Both notes direct victims to Tor-based portals for negotiation.

Known Malware Sample

A publicly analyzed malware sample associated with Tengu has the following hashes:

  • SHA-256:
    fafb6c5e12dfeefaba5ac8982d5bb13dd206cfcd328b9d36aa87257f762ee24a
  • MD5:
    dfbc9412be99b25137ab6ab575489a93

The file is an unsigned .NET executable containing functionality designed to disable Microsoft Defender.

Interestingly, the same hash has been labeled “SalatStealer” on ThreatFox. However, sandbox analysis shows behavior consistent with ransomware. This overlap may indicate either multi-purpose malware tooling or misclassification within threat intelligence datasets.

Recommended Defensive Measures

Security teams can reduce risk from Tengu intrusions by focusing on the access paths and behaviors commonly used in these attacks.

Strengthen Remote Access Security

Because exposed remote services combined with valid credentials are the main entry point, organizations should prioritize:

  • Enforcing phishing-resistant MFA, such as FIDO2 or WebAuthn, for all remote and privileged access
  • Eliminating direct internet exposure of RDP services
  • Deploying conditional access policies
  • Monitoring for unusual login activity, including:
    • impossible travel scenarios
    • first-time device usage
    • unexpected administrative authentications

Detect Post-Compromise Activity

Security monitoring should focus on behavioral indicators such as:

  • Event log clearing using wevtutil cl, particularly when combined with other administrative tool usage
  • Attempts to disable Defender or EDR tools via PowerShell
  • Registry Run-key persistence matching values like:
    • WraithNet
    • SystemSecurityMonitor
    • WindowsSecurityUpdate
  • Scheduled task creation from suspicious contexts
  • Execution of binaries from temporary directories

Monitor Data Exfiltration

Since Rclone and WinSCP are commonly used for data theft, organizations should restrict or closely monitor these tools if they are not required for normal operations.

Additional controls such as Data Loss Prevention (DLP) and User and Entity Behavior Analytics (UEBA) can help detect large or unusual outbound transfers.

Protect Backup Systems

Tengu operators frequently attempt to prevent recovery by deleting Volume Shadow Copies and clearing logs. To counter this tactic, organizations should maintain:

  • Offline or immutable backups
  • Segregated backup networks
  • Separate administrative credentials for backup systems

Regular restoration testing is also essential to ensure that recovery processes work during an incident.

Intelligence Gaps

Despite growing analysis, several aspects of Tengu operations remain unclear:

  • Encryption mechanisms have not been publicly reverse-engineered, despite claims of “military-grade encryption” in ransom notes.
  • Initial access details beyond valid credential abuse remain limited, with no confirmed phishing campaigns or exploited vulnerabilities tied to the group.
  • The connection between WraithNet artifacts and the encryption component is still uncertain; it is unclear whether they represent operator tooling, part of the ransomware chain, or separate infrastructure.
  • The SalatStealer classification overlap raises questions about shared toolsets between credential-stealing malware and ransomware operations.

Key Takeaway

Tengu’s success does not come from novel techniques but from consistent use of well-known attack methods. The group relies on credential abuse, legitimate system tools, large-scale data exfiltration using standard utilities, and aggressive efforts to disable recovery mechanisms.

For defenders, this means that established cybersecurity fundamentals remain highly effective. Strong MFA on remote access systems, well-tuned endpoint detection, careful monitoring of outbound traffic, and resilient backup strategies can significantly reduce the impact of attacks using the Tengu playbook.

CyberDefender