Skip to main content
Darkfield

Operator dossier

tengu is a ransomware operator currently active on public leak sites. Darkfield has indexed 59 public victims claimed by this operator between October 23, 2025 and May 28, 2026. Tengu is a recently emerged ransomware group first observed in October 2025, operating with apparent financial motivations and demonstrating a geographically diverse targeting approach across 49 documented victims. The group has primarily focused their operations on Morocco, the United States, India, Italy, and Indonesia, suggesting either opportunistic targeting or specific interest in these regions' economic sectors. Their victim profile spans multiple industries including technology, manufacturing, public sector, and agriculture and food production, indicating a broad targeting strategy rather than sector-specific focus. Due to the group's recent emergence and limited public documentation from established threat intelligence sources, specific details regarding their origin, affiliation status, technical methodology, encryption techniques, and operational structure remain largely undocumented by major cybersecurity agencies and research organizations. No notable high-profile campaigns or law enforcement actions have been publicly reported by CISA, FBI, or prominent security researchers at this time. The group's current operational status appears active given their recent emergence, though comprehensive threat intelligence profiles from established sources have yet to be published due to their nascent presence in the ransomware landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by tengu

All 59 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for tengu →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

tengu

59 victims indexed · first seen 9 months ago · last activity 2 months ago

59
Victims indexed
#100 of 364 tracked operators
7m
Active period
Oct 2025 → May 2026
10
Countries hit
top IN · 4

At a glance

Status
active
First seen
9 months ago
Last activity
2 months ago
Onion sites
1 known endpoint
Primary sector
Not Found · 20 hits

About

Tengu is a recently emerged ransomware group first observed in October 2025, operating with apparent financial motivations and demonstrating a geographically diverse targeting approach across 49 documented victims. The group has primarily focused their operations on Morocco, the United States, India, Italy, and Indonesia, suggesting either opportunistic targeting or specific interest in these regions' economic sectors. Their victim profile spans multiple industries including technology, manufacturing, public sector, and agriculture and food production, indicating a broad targeting strategy rather than sector-specific focus. Due to the group's recent emergence and limited public documentation from established threat intelligence sources, specific details regarding their origin, affiliation status, technical methodology, encryption techniques, and operational structure remain largely undocumented by major cybersecurity agencies and research organizations. No notable high-profile campaigns or law enforcement actions have been publicly reported by CISA, FBI, or prominent security researchers at this time. The group's current operational status appears active given their recent emergence, though comprehensive threat intelligence profiles from established sources have yet to be published due to their nascent presence in the ransomware landscape.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

6 months
2025-10-01T00:00:00+00:00 · 62025-11-01T00:00:00+00:00 · 22025-12-01T00:00:00+00:00 · 12026-01-01T00:00:00+00:00 · 282026-02-01T00:00:00+00:00 · 82026-03-01T00:00:00+00:00 · 4
2025-10-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇮🇳 India
4
🇲🇦 Morocco
4
🇺🇸 United States
4
🇮🇹 Italy
3
🇮🇩 Indonesia
3
🇲🇽 Mexico
3
🇬🇧 United Kingdom
2
🇫🇷 France
2
India dossier →Morocco dossier →United States dossier →Italy dossier →

Top sectors

Technology
6
Manufacturing
5
Public Sector
4
Agriculture and Food Production
4
Hospitality and Tourism
3
Education
2
Financial Services
1
Construction
1
Technology dossier →Manufacturing dossier →Public Sector dossier →Agriculture and Food Production dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onion

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time tengu posts a victim.

Add tengu to your watchlist — Pro pings you within 5 minutes of any new tengu leak-site post, Telegram callout, or affiliate-rebrand inference.