Trigona ransomware affiliates use custom exfiltration tool in renewed attacks

Symantec reported that Trigona ransomware affiliates used a custom-built data theft utility, uploader_client.exe, in recent intrusions, replacing common exfiltration tools such as Rclone and MegaSync. The command-line tool connected to a hardcoded attacker-controlled server and was designed to steal high-value files from network drives, including invoices and PDFs, while lowering detection risk. Reported capabilities included parallel upload streams, TCP connection rotation after large transfers, file-extension filtering, and shared-key authentication, indicating a more mature and deliberate approach to exfiltration by affiliates tied to the Rhantus ransomware-as-a-service operation.

The attacks also involved a broader toolset to weaken defenses and expand access before data theft. Investigators said the actors attempted to disable security controls with utilities including HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd, often abusing vulnerable kernel drivers and using PowerRun for elevated execution. They then used AnyDesk for remote access and Mimikatz plus Nirsoft password recovery tools for credential theft. The activity suggests Trigona, which had lower visibility after disruption in 2023, has remained active and resumed operations with more customized and stealthy tradecraft.