Tengu
A ransomware-as-a-service operation first seen in October 2025. Its leak site was rebranded as Shisa Ransomware in March 2026. Vendors report credential abuse against exposed RDP and VPN services as its main way in.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Flare describes a hands-on-keyboard model where affiliates carry out intrusions while a core team maintains the ransomware and extortion infrastructure.2 SOCRadar reports builds for Windows, Linux and ESXi.1
SOCRadar says the true origin is unconfirmed. It notes the program bars attacks on Russia and CIS countries, a common carve-out in Russian-language programmes, without drawing a conclusion.1
The sources do not establish a UK link.
Everything reported here starts with an exposed login service. Removing internet-facing RDP and enforcing MFA on VPN would address the main reported route.
How It Attacks
Based on Flare and SOCRadar reporting from 2026.2,1 Phishing and exploitation are described as secondary or unconfirmed routes.
- 1
Get In
Brute-forces or reuses credentials against exposed RDP, VPN or SMB services, often through proxies.
- 2
Weaken Defences
Disables Windows Defender, alters services and clears logs.
- 3
Stay and Harvest
Uses Run keys and scheduled tasks, and dumps LSASS for credentials.
- 4
Steal the Data
Exfiltrates with Rclone and WinSCP.
- 5
Encrypt
Deletes shadow copies and encrypts files, using intermittent encryption on file headers.
Key Techniques
Our mapping of the behaviour Flare and SOCRadar describe.2,1 Tengu has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Uses valid accounts against RDP and VPN. |
| T1110 | Brute Force | Credential Access | Brute-forces exposed RDP and SMB. |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence | Sets Run keys for persistence. |
| T1053.005 | Scheduled Task | Persistence | Uses scheduled tasks for persistence. |
| T1685 | Disable or Modify Tools | Defense Impairment | Disables Windows Defender. |
| T1685.005 | Clear Windows Event Logs | Defense Impairment | Clears logs with wevtutil. |
| T1003.001 | LSASS Memory | Credential Access | Dumps LSASS. |
| T1048 | Exfiltration Over Alternative Protocol | Exfiltration | Uses Rclone and WinSCP. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files. |
Defences That Matter
Protect Remote Access
- Require phishing-resistant MFA on VPN, RDP and administrator accounts.
- Remove internet-facing RDP where possible and review dormant accounts.
Watch for Hands-On Activity
- Monitor for unapproved remote access tools, renamed file transfer utilities and large outbound transfers.
- Alert on attempts to stop security tools or delete shadow copies.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Is RDP Exposed on Your Network?
We can find your exposed services and help you lock them down.
Sources
- SOCRadar: Dark web profile: Tengu ransomware (Shisa), 11 June 2026
- Flare: Tengu ransomware: what security teams need to know, 12 March 2026, modified 18 June 2026
- Comparitech: Ransomware roundup, March 2026, 1 April 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.