Tengu Ransomware: Attack Chain From Initial Access to Encryption

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Tengu Ransomware: Attack Chain From Initial Access to Encryption

Overview

Tengu is a Ransomware-as-a-Service (RaaS) operation that relies on a double-extortion model. The threat actors steal sensitive information prior to encryption and use a Tor browser-based portal to negotiate with victims. Rather than deploying custom malware, Tengu operators heavily utilize Living Off The Land Binaries (LOLBins) to execute payloads, allowing their malicious activities to blend in with normal administrative traffic.

Article Link: Tengu Ransomware: Attack Chain From Initial Access to Encryption