Tornado Defunct

Ransomware group first observed in 2024. Uses QBot for deployment.
PDF Report Back to Groups
0
Total Victims
2024-04-01
First Seen
2025-07-12
Last Seen
5
Known TTPs
15.0d
Avg Delay
0
Negotiations
ONION URLS
6zfvl5cmrbeu5u2jxfq5owrvlaikzsh6x6jynvdzvxbei3fylwamvtxc.onion
TOOLS
QBot PsExec TeamViewer
FILE EXTENSIONS
.oops
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
Date Victim Name Country Sector Status
No victims recorded
Technique ID Technique Name Tactic
T1049 System Network Connections Discovery Discovery
T1069 Permission Groups Discovery Discovery
T1189 Drive-by Compromise Initial Access
T1021.002 SMB/Windows Admin Shares Lateral Movement
T1136.001 Local Account Persistence

No YARA rules

No IoCs

No ransom notes