tengu
Also known as: ShisaFirst seen October 23, 2025Active49 claimed victims
The claims below are reproduced as posted by tengu on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Tengu is a RaaS operation first observed in October 2025, following a double-extortion model and using Living Off The Land Binaries (LOLBins) to blend malicious activity with normal admin traffic, primarily targeting consumer goods, real estate, automotive, healthcare, and IT sectors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sileno Companies Inc | March 7, 2026 | ransomware_live | — |
| Eos Technology srl | March 4, 2026 | ransomware_live | — |
| Communitymosaic.co.uk | March 4, 2026 | ransomware_live | — |
| DAINTY CLOUD INC | March 1, 2026 | ransomware_live | — |
| martec.it | February 25, 2026 | ransomware_live | — |
| Al Arif Contracting Co. (L.L.C) | February 25, 2026 | ransomware_live | — |
| www.shora.ma | February 20, 2026 | ransomware_live | — |
| 真言宗智山派 成就院 | February 18, 2026 | ransomware_live | — |
| femar.it | February 18, 2026 | ransomware_live | — |
| PT. Mitra Antar Tangguh | February 10, 2026 | ransomware_live | — |
| Junta Local de Conciliación y Arbitraje | February 10, 2026 | ransomware_live | — |
| megasilver.com.tw | February 4, 2026 | ransomware_live | — |
| all Data | January 31, 2026 | ransomware_live | — |
| We will be back soon | January 30, 2026 | ransomware_live | — |
| b2motorsport.co.il | January 29, 2026 | ransomware_live | — |
| Tahkout Group | January 28, 2026 | ransomware_live | — |
| skyegtours.com | January 27, 2026 | ransomware_live | — |
| COMPAGNIE FONCIÈRE PARISIENNE | January 27, 2026 | ransomware_live | — |
| lenotech.com.ph | January 27, 2026 | ransomware_live | — |
| FRUIT-BONTÉ Agroalimentaire | January 27, 2026 | ransomware_live | — |
| KSP TLM INDONESIA | January 27, 2026 | ransomware_live | — |
| Jakarta Nanyang School | January 26, 2026 | ransomware_live | — |
| namico.go.ke | January 26, 2026 | ransomware_live | — |
| premmotors.com | January 26, 2026 | ransomware_live | — |
| Disuelas JC SAS | January 26, 2026 | ransomware_live | — |
| STRONG WINGS LLP | January 22, 2026 | ransomware_live | — |
| www.coconutboard.gov.in | January 20, 2026 | ransomware_live | — |
| Deck India Engineering Pvt. Ltd | January 19, 2026 | ransomware_live | — |
| GSM PORTAL TEKNOLOJİ HİZMETLERİ TİC. LTD. ŞTİ | January 18, 2026 | ransomware_live | — |
| anfibius.net | January 17, 2026 | ransomware_live | — |
| Nafae Sanitaire S.a.r.l | January 17, 2026 | ransomware_live | — |
| Grupo Roa | January 16, 2026 | ransomware_live | — |
| https://comercialautomotriz.com | January 16, 2026 | ransomware_live | — |
| Nordstrom Rack | January 15, 2026 | ransomware_live | — |
| Quick Safety Electric | January 14, 2026 | ransomware_live | — |
| https://seha.org.sa | January 14, 2026 | ransomware_live | — |
| Samson Equipment | January 14, 2026 | ransomware_live | — |
| www.charoenchai.com | January 12, 2026 | ransomware_live | — |
| strategic-ts.com | January 7, 2026 | ransomware_live | — |
| baja.gob.mx | January 6, 2026 | ransomware_live | — |
| https://www.revnomix.com | December 8, 2025 | ransomware_live | — |
| **Rollingertec S.A. - Luxembourg** | November 27, 2025 | ransomware_live | — |
| Coral Clubes - Mexico | November 23, 2025 | ransomware_live | — |
| Le MULTI LABORATOIRE LC2A | October 24, 2025 | ransomware_live | — |
| Qatargas and Tar Company, Iran | October 23, 2025 | ransomware_live | — |
| STAR LÉGUMES | October 23, 2025 | ransomware_live | — |
| Al Rimal Group | October 23, 2025 | ransomware_live | — |
| FOOD & MUSIC MANAGEMENT SL | October 23, 2025 | ransomware_live | — |
| UniCursos, Brazil | October 23, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).