Tortilla
Tortilla is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in 8 countries, including the United States and the United Kingdom.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2021
- Record updated
Who They Target.
About Tortilla.
The actor of the campaign is sometimes referred to as Tortilla, based on the payload file names used in the campaign. This is a new actor operating since July 2021. Prior to this ransomware, Tortilla has been experimenting with other payloads, such as the PowerShell-based netcat clone Powercat, which is known to provide attackers with unauthorized access to Windows machines. We assess with moderate confidence that the initial infection vector is exploitation of ProxyShell vulnerabilities in Microsoft Exchange Server through the deployment of China Chopper web shell.
Last updated Oct 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.