Skip to content
Install MCP

Threat actor

Toru Group

Last fetched

Toru Group is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Toru Group, run by Israeli national Assaf Elias, serves as an intermediary in facilitating the global sale of advanced surveillance and spyware technologies. The company has reportedly acted as a middleman for deals involving firms linked to Tal Dilian's surveillance empire, including Passitora and Intellexa. In June 2021, Toru Group won a bid to supply Bangladesh with a “Vehicle Mounted Mobile Interceptor” spy vehicle. The spy van, delivered in mid-2022, is reportedly in use by Bangladeshi authorities, with its surveillance tools allegedly leading to the dismissal of police officers accused of criticizing the government in private WhatsApp groups.

Techniques by tactic

No ATT&CK techniques are recorded for Toru Group in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Toru Group today — this states the absence of a published link, not that Toru Group has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Toru Group into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.