Loading story…
The Ukrainian Cyber Alliance (UCA) said it breached the Trigona ransomware gang’s infrastructure, exfiltrated internal data, and wiped and defaced servers, knocking the group’s public-facing services offline. According to reports, the activists gained initial access by exploiting CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server, then remained undetected while mapping Trigona’s environment and extracting data from administration and victim panels, internal tools, source code repositories, databases, developer systems, leak-site infrastructure, and cryptocurrency hot wallets.
The stolen data reportedly included hundreds of gigabytes of backups and documents, and may also contain decryption keys that could aid victims. Trigona, a ransomware operation active since 2022, had targeted organizations in sectors including manufacturing and finance and had previously used exposed Microsoft SQL servers as an intrusion vector. Following the intrusion, Trigona’s websites and operational services were reported offline, with UCA claiming the action effectively dismantled the gang’s infrastructure.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Following the server compromise and wiping, Trigona's public websites and related services were reported offline.
UCA then wiped and defaced Trigona's servers, an action reported to have taken the ransomware operation offline and dismantled its infrastructure.
After gaining access, UCA reportedly stole hundreds of gigabytes of data from Trigona's administration and victim panels, internal tools, source code repositories, databases, backups, and cryptocurrency hot wallets; the haul may also have included decryption keys.
The Ukrainian Cyber Alliance said it gained initial access to Trigona infrastructure through a public exploit for CVE-2023-22515, a critical Atlassian Confluence Data Center and Server vulnerability, and remained undetected while mapping the environment.
Earlier in 2023, Trigona used exposed Microsoft SQL servers as an intrusion vector in attacks against organizations across multiple sectors.
The Trigona ransomware operation was publicly branded and identified in late October 2022 after earlier malware activity had already been observed.
Malware samples associated with the Trigona ransomware operation were first seen in early 2022, marking the earliest known activity tied to the group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that **Trigona** ransomware affiliates used a custom-built data theft utility, `uploader_client.exe`, in recent intrusions, replacing common exfiltration tools such as Rclone and MegaSync. The command-line tool connected to a hardcoded attacker-controlled server and was designed to steal high-value files from network drives, including invoices and PDFs, while lowering detection risk. Reported capabilities included parallel upload streams, TCP connection rotation after large transfers, file-extension filtering, and shared-key authentication, indicating a more mature and deliberate approach to exfiltration by affiliates tied to the **Rhantus** ransomware-as-a-service operation. The attacks also involved a broader toolset to weaken defenses and expand access before data theft. Investigators said the actors attempted to disable security controls with utilities including **HRSword**, **PCHunter**, **Gmer**, **YDark**, **WKTools**, **DumpGuard**, and **StpProcessMonitorByovd**, often abusing vulnerable kernel drivers and using **PowerRun** for elevated execution. They then used **AnyDesk** for remote access and **Mimikatz** plus Nirsoft password recovery tools for credential theft. The activity suggests Trigona, which had lower visibility after disruption in 2023, has remained active and resumed operations with more customized and stealthy tradecraft.
Jun 29, 2026
Trigona ransomware hit at least 15 organizations across manufacturing, finance, construction, agriculture, marketing, and high technology, with activity accelerating after its emergence in late 2022. The malware drops an unusual HTML Application ransom note, **`how_to_decrypt.hta`**, which contains embedded JavaScript, victim-specific identifiers, contact emails, and a Tor-based negotiation portal. Trigona encrypts files using Delphi AES functionality, appends the **`._locked`** extension, and has been linked to leak-site infrastructure used to pressure victims. Investigators observed operators using **NetScan**, **Splashtop**, **Mimikatz**, **Advanced Port Scanner**, and batch scripts to conduct reconnaissance, steal credentials, move laterally, evade defenses, and clean up traces of activity. The intrusion set also established persistence through Windows **`CurrentVersion\Run`** registry keys, aligning with common persistence tradecraft such as **MITRE ATT&CK `T1136` Create Account** in broader enterprise environments. Researchers also noted overlaps with **BlackCat** leak posts and **CryLock** tradecraft, indicating possible operational links or an evolution of earlier ransomware activity.
Aug 15, 2026
Destructive malware operations against organizations in Ukraine included **CaddyWiper** and a separate pseudo-ransomware campaign that posed as extortion but was built to permanently destroy data. Researchers said CaddyWiper shared no code with earlier payloads such as **HermeticWiper**, but it similarly targeted user files, mapped drives, and disk partitions while avoiding execution on primary domain controllers through a domain-controller kill switch. U.S. authorities warned that multiple malware families were being used in coordinated attacks on Ukrainian networks, underscoring the risk of disruptive and irreversible data loss. Technical analysis showed the attacks relied on enterprise compromise and staged payload delivery rather than simple smash-and-grab deployment. CaddyWiper checked domain-controller status via the `DsRolePrimaryDomainInformation` API and wiped disks using low-level Windows functions, while defenders observed destructive payloads being pushed at scale through compromised **Group Policy Objects** after attackers obtained domain administrator access. In the pseudo-ransomware case, the intrusion chain used an MBR wiper, a downloader retrieving payloads from Discord CDN, a .NET loader that disabled Microsoft Defender and used process hollowing, and a final C-based wiper that overwrote files across 191 extensions before shutting systems down, leaving victims with no practical recovery path despite the ransom note.
Aug 15, 2026