Trigona

Trigona is a financially motivated ransomware-as-a-service (RaaS) operation active since 2022. It operates Windows and Linux encryptors and uses a double-extortion model: affiliates steal selected victim data before encrypting systems and threaten publication through leak-site and negotiation infrastructure. The operation has used Monero for ransom payments and maintains affiliate-oriented operational infrastructure. Trigona has targeted organizations in technology, health care, manufacturing, financial services, construction, agriculture, marketing, and other sectors. Its operators have repeatedly targeted internet-exposed Microsoft SQL Server environments, gaining access through weak or brute-forced credentials, compromised accounts, and exploitation of vulnerable public-facing software, including CVE-2021-40539. Intrusions have included reconnaissance, network scanning, credential dumping, creation of privileged or remote-access-capable accounts, use of remote-management software, and lateral movement over RDP and other administrative mechanisms. The group has used CLR-based SQL Server command execution and the SQL Server Bulk Copy Program to stage malware from database content. It has deployed ransomware directly as well as Mimic ransomware in closely related activity. Trigona operators have used security-disabling tools, elevated-execution utilities, vulnerable kernel drivers, credential-recovery utilities, and backup- and recovery-inhibition techniques. They have also used AnyDesk and other remote-access tooling to maintain hands-on access. For data theft, Trigona affiliates previously used publicly available transfer tools including Rclone. In 2026, affiliates were observed using a custom command-line uploader designed to prioritize high-value documents, use parallel transfers, rotate network connections, and filter unwanted file types. The operation was disrupted when Ukrainian Cyber Alliance actors compromised and wiped its infrastructure in October 2023, but subsequent activity demonstrated that Trigona continued or resumed operations.