Loading story…
Symantec reported that Trigona ransomware affiliates used a custom-built data theft utility, uploader_client.exe, in recent intrusions, replacing common exfiltration tools such as Rclone and MegaSync. The command-line tool connected to a hardcoded attacker-controlled server and was designed to steal high-value files from network drives, including invoices and PDFs, while lowering detection risk. Reported capabilities included parallel upload streams, TCP connection rotation after large transfers, file-extension filtering, and shared-key authentication, indicating a more mature and deliberate approach to exfiltration by affiliates tied to the Rhantus ransomware-as-a-service operation.
The attacks also involved a broader toolset to weaken defenses and expand access before data theft. Investigators said the actors attempted to disable security controls with utilities including HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd, often abusing vulnerable kernel drivers and using PowerRun for elevated execution. They then used AnyDesk for remote access and Mimikatz plus Nirsoft password recovery tools for credential theft. The activity suggests Trigona, which had lower visibility after disruption in 2023, has remained active and resumed operations with more customized and stealthy tradecraft.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On April 23, 2026, Symantec publicly reported that recent Trigona attacks used custom-built exfiltration malware, assessing this as a sign of greater technical maturity and a shift toward lower-profile data theft. The disclosure also noted the activity suggests Trigona has resumed operations.
During the March 2026 attacks, the operators attempted to disable security tools using HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd, often via vulnerable kernel drivers and PowerRun. They also used AnyDesk for remote access and Mimikatz plus Nirsoft password recovery tools for credential theft.
In March 2026, Symantec observed Trigona-linked intrusions using a custom command-line exfiltration utility named uploader_client.exe instead of common tools like Rclone or MegaSync. The tool used a hardcoded attacker-controlled server, parallel uploads, connection rotation, file-type filtering, and shared-key authentication to steal targeted documents from network drives.
Reporting cited by DataBreaches indicated Trigona continued conducting attacks in 2024 even though its known URLs were down and public signs of activity were limited. This showed the group had not fully ceased operations after the 2023 disruption.
Trigona's operations were disrupted by Ukrainian cyber activists in October 2023. Afterward, the group had limited public visibility and was at times thought to have disappeared.
Trigona first appeared in late 2022 as a double-extortion ransomware-as-a-service operation. Symantec tracks the operation behind it as Rhantus.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesecurity.com
Open sourcebleepingcomputer.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trigona ransomware hit at least 15 organizations across manufacturing, finance, construction, agriculture, marketing, and high technology, with activity accelerating after its emergence in late 2022. The malware drops an unusual HTML Application ransom note, **`how_to_decrypt.hta`**, which contains embedded JavaScript, victim-specific identifiers, contact emails, and a Tor-based negotiation portal. Trigona encrypts files using Delphi AES functionality, appends the **`._locked`** extension, and has been linked to leak-site infrastructure used to pressure victims. Investigators observed operators using **NetScan**, **Splashtop**, **Mimikatz**, **Advanced Port Scanner**, and batch scripts to conduct reconnaissance, steal credentials, move laterally, evade defenses, and clean up traces of activity. The intrusion set also established persistence through Windows **`CurrentVersion\Run`** registry keys, aligning with common persistence tradecraft such as **MITRE ATT&CK `T1136` Create Account** in broader enterprise environments. Researchers also noted overlaps with **BlackCat** leak posts and **CryLock** tradecraft, indicating possible operational links or an evolution of earlier ransomware activity.
Aug 15, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
The **Ukrainian Cyber Alliance (UCA)** said it breached the Trigona ransomware gang’s infrastructure, exfiltrated internal data, and wiped and defaced servers, knocking the group’s public-facing services offline. According to reports, the activists gained initial access by exploiting **`CVE-2023-22515`**, a critical vulnerability in **Atlassian Confluence Data Center and Server**, then remained undetected while mapping Trigona’s environment and extracting data from administration and victim panels, internal tools, source code repositories, databases, developer systems, leak-site infrastructure, and cryptocurrency hot wallets. The stolen data reportedly included **hundreds of gigabytes** of backups and documents, and may also contain **decryption keys** that could aid victims. Trigona, a ransomware operation active since 2022, had targeted organizations in sectors including manufacturing and finance and had previously used exposed **Microsoft SQL servers** as an intrusion vector. Following the intrusion, Trigona’s websites and operational services were reported offline, with UCA claiming the action effectively dismantled the gang’s infrastructure.
Jun 29, 2026