Ransomware Group intelligence
Toufan
InactiveTrack Toufan with 117 published victims and 6 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Toufan is tracked by Breach House as a ransomware group with 117 published victims.
Israel is currently the most targeted country in this dataset.
6 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (6)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Web location | Up checked 1h ago | t.me/s/CyberToufanBackup |
| Leak location 2 | Web location | Up checked 1h ago | t.me/s/CyberToufan |
| Leak location 3 | Web location | Up checked 1h ago | t.me/CyberToufan |
| Leak location 4 | Web location | Up checked 1h ago | t.me/CyberToufan02 |
| Leak location 5 | Web location | Up checked 1h ago | t.me/CyberToufanBackup |
| Leak location 6 | Web location | Up checked 1h ago | toufanleaks.org |
Top Activity Sectors (6)
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Toufan, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: toufan executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: toufan leverages native API calls to bypass detection while executing malicious commands against target systems.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: toufan modifies registry run keys to ensure malware execution upon system reboot for persistence.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: toufan disables antivirus tools and security software to prevent system recovery and hinder forensic analysis.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.002 Software Packing Stealth
What they do: toufan applies software packing to obfuscate malware binaries, evading signature-based detection mechanisms.
What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.
-
T1070.004 File Deletion Stealth
What they do: toufan deletes Volume Shadow Copies and backup directories to eliminate recovery options for affected systems.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: toufan conducts remote system discovery to map network topology and identify additional high-value targets.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1049 System Network Connections Discovery Discovery
What they do: toufan queries system network connections to identify active services and communication endpoints for targeting.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1057 Process Discovery Discovery
What they do: toufan performs process discovery to identify critical services and isolate high-value targets for encryption.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: toufan exploits SMB/Windows Admin Shares to move laterally across networked machines within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: toufan encrypts victim files using custom ransomware routines, locking data for extortion demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: toufan invokes Inhibit System Recovery techniques to block automatic restoration processes and maximize impact.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (117)
Search, filter and paginate the victim timeline for Toufan. Showing 1–100 of 117.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | ecom.gov.il id10307 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | maytronics.com id10306 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | carolinalemke.com id10301 View details | Germany | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | ari.co.il id10300 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | allot.com id10279 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | bconnect.co.il id10273 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | super-pharm.co.il id10272 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | teldor.com id10261 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | erco.co.il id10260 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | tefentech.com id10230 View details | Israel | IT | — | |
|
No additional victim description available. |
|||||
| Ransomware | zoko.co.il id10229 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | strauss-group.com id10188 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.pts-tools.com id10184 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.plasson-pead.com.br id10183 View details | Brazil | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | www.nistx.com id10182 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.ktstooling.com id10181 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.herrickindustrial.com id10180 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.drillmex.com id10179 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.dixie-tool.com id10178 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.copreinternacional.com id10177 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.butlerbros.com id10176 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | www.atwoodindustries.com id10175 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | wsies.com id10174 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | vehicle.touch-ins.co.il id10173 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | tryhardindustrial.ca id10172 View details | Canada | Manufacturing / Engineering | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys.udidagan.co.il id10171 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys.touch-ins.co.il id10170 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys-cspartnershq1.caesarstone.com id10169 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | sys-cspartners.caesarstoneus.com id10168 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | sys-cspartners.caesarstone.sg id10167 View details | Singapore | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys-cspartners.caesarstone.co.uk id10166 View details | United Kingdom | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys-cspartners.caesarstone.com.au id10165 View details | Australia | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys-cspartners.caesarstone.ca id10164 View details | Canada | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | sys.biopet.co.il id10163 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | store.toolneeds.com id10162 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | store.brunswickindustrial.com id10161 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | stage.kravitz.co.il id10160 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | shop.smithindustrialsupply.com id10159 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.shopsupply.net id10158 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.reggiemckenzieindustrial.com id10157 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.qct.tools id10156 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.lgindustrial.com id10155 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.emprecise.com id10154 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.clador.com id10153 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shop.britecon.com id10152 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | shefa-online.co.il id10151 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | selwayindustrialsupply.com id10150 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | rocket-supply.com id10149 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | rmpis.com id10148 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | reserved-il.com id10147 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | pts-tools.com id10146 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | product.touch-ins.co.il id10145 View details | Israel | Communication / Marketing | — | |
|
No additional victim description available. |
|||||
| Ransomware | pmt-usa.com id10144 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | phoenix.touch-ins.co.il id10143 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | pet.touch-ins.co.il id10142 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | pet.biopet.co.il id10141 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | paragon-supply.com id10140 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | old.shefa-online.co.il id10139 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | norviktools.com id10138 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | northernprecisionsales.com id10137 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | newstore.johnstoncompanies.com id10136 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | mortgage.touch-ins.co.il id10135 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | morsecuttingtools.com id10134 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | mitchellmckinney.com id10133 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | mgisales.com id10132 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | m.biopet.co.il id10131 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | libertytool.com id10130 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | ktstooling.com id10129 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | knightesupply.com id10128 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | keter.com id10127 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | keter.co.il id10126 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | its-supply.com id10125 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | h-o.co.il id10124 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | goronco.com id10123 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | gordonindustrial.com id10122 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | global.keter.com id10121 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | giddirect.com id10120 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | gfwdsupply.com id10119 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | fugatesales.com id10118 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | drillmex.com id10117 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | dixie-tool.com id10116 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | dctsupply.com id10115 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | cspartnershq1.caesarstone.com id10114 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | cspartners.caesarstoneus.com id10113 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | cspartners.caesarstone.sg id10112 View details | Singapore | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | cspartners.caesarstone.co.uk id10111 View details | United Kingdom | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | cspartners.caesarstone.com.au id10110 View details | Australia | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | cspartners.caesarstone.ca id10109 View details | Canada | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | core.touch-ins.co.il id10108 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | copreinternacional.com id10107 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | colmarindustrial.com id10106 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | cmtindustrial.com id10105 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | cdt1.com id10104 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | catalog.ustg.net id10103 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | catalog.toolkrib.com id10102 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | catalog.fotcnc.com id10101 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | cartersoshkosh.co.il id10100 View details | Israel | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | butlerbros.com id10099 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | blueashsupply.com id10098 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | berkshireesupply.com id10097 View details | Other | — | ||
|
No additional victim description available. |
|||||