Toufan Ransomware

Description Summary

Pro-Palestinian Group.

Threat Actor

Iranian-linked hacktivist (pro-Palestinian); persona-linked to Handala.

Technical Indicators

Encryption Extension
N/A — data theft/wiping, not encryption
Encryption Algorithm
N/A
Ransom Note Name
N/A
Targeted Industries
Israeli government, defense, finance, critical infrastructure
First Seen
16 November 2023 (Cyber Toufan)
Last Seen
Active
Geographical Location
Israel

MITRE ATT&CK Matrix

Tactic TTP Technique Name
Impact x 2 T1486 Data Encrypted for Impact
T1490 Inhibit System Recovery
Exfiltration x 1 T1567 Exfiltration Over Web Service (leak site)
Initial Access x 2 T1190 Exploit Public-Facing Application
T1078 Valid Accounts