Skip to content
brandefense.io
Request A Demo
RansomwareUnknown

Tengu

Tengu is a ransomware group, tracked by Brandefense. It targets 3 sectors, including Manufacturing, and Retail and Consumer, in 7 countries, including the United States and India.

Also known as
  • Shisa
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

Who They Target.

Sectors · 3
Countries · 7

About Tengu.

Tengu is a RaaS operation first observed in October 2025, following a double-extortion model and using Living Off The Land Binaries (LOLBins) to blend malicious activity with normal admin traffic, primarily targeting consumer goods, real estate, automotive, healthcare, and IT sectors.

Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.