Tengu is a ransomware-as-a-service (RaaS) operation that first emerged in October 2025. The group operates with a clear financial motivation, employing a double-extortion model where data is exfiltrated before encryption to pressure victims into payment. Tengu distinguishes itself through its heavy reliance on Living Off The Land Binaries (LOLBins) to blend malicious activities with legitimate system traffic, and its use of intermittent encryption to rapidly encrypt large environments. The group also maintains a structured affiliate program, reportedly offering an 80/20 revenue split to its partners and requiring a deposit from affiliates without victim data. In March 2026, Tengu rebranded and began operating under the alias "Shisa Ransomware".

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker