ransomware-group-operationhacktivist-operationoperational-disruptionthreat-infrastructure-tracking

Ukrainian Cyber Alliance Breaches Trigona Ransomware and Wipes Its Servers

Active Exploitation · 3 sources · Updated 4mo ago · First seen May 25, 2026

The Ukrainian Cyber Alliance (UCA) said it breached the Trigona ransomware gang’s infrastructure, exfiltrated internal data, and wiped and defaced servers, knocking the group’s public-facing services offline. According to reports, the activists gained initial access by exploiting CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server, then remained undetected while mapping Trigona’s environment and extracting data from administration and victim panels, internal tools, source code repositories, databases, developer systems, leak-site infrastructure, and cryptocurrency hot wallets.

The stolen data reportedly included hundreds of gigabytes of backups and documents, and may also contain decryption keys that could aid victims. Trigona, a ransomware operation active since 2022, had targeted organizations in sectors including manufacturing and finance and had previously used exposed Microsoft SQL servers as an intrusion vector. Following the intrusion, Trigona’s websites and operational services were reported offline, with UCA claiming the action effectively dismantled the gang’s infrastructure.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Jun 1, 2022 – Oct 18, 2023

Oct 18, 20233y ago
Trigona public websites and services reported offline
Following the server compromise and wiping, Trigona's public websites and related services were reported offline.
Oct 18, 20233y ago
UCA wipes and defaces Trigona servers, disrupting operations
UCA then wiped and defaced Trigona's servers, an action reported to have taken the ransomware operation offline and dismantled its infrastructure.
Oct 4, 20233y ago
UCA exfiltrates Trigona data including panels, source code, and wallets
After gaining access, UCA reportedly stole hundreds of gigabytes of data from Trigona's administration and victim panels, internal tools, source code repositories, databases, backups, and cryptocurrency hot wallets; the haul may also have included decryption keys.
Oct 4, 20233y ago
Ukrainian Cyber Alliance exploits CVE-2023-22515 to access Trigona systems
The Ukrainian Cyber Alliance said it gained initial access to Trigona infrastructure through a public exploit for CVE-2023-22515, a critical Atlassian Confluence Data Center and Server vulnerability, and remained undetected while mapping the environment.
Apr 19, 20234y ago
Trigona targets exposed Microsoft SQL servers
Earlier in 2023, Trigona used exposed Microsoft SQL servers as an intrusion vector in attacks against organizations across multiple sectors.
Oct 25, 20224y ago
Trigona brand becomes publicly identified
The Trigona ransomware operation was publicly branded and identified in late October 2022 after earlier malware activity had already been observed.
Jun 1, 20224y ago
Trigona ransomware activity first observed in malware samples
Malware samples associated with the Trigona ransomware operation were first seen in early 2022, marking the earliest known activity tied to the group.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

2 linked

Ukrainian Cyber Alliance Trigona

Malware

1 linked

Trigona

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

ScworldNews · Oct 19, 2023

Trigona ransomware claimed to be dismantled by Ukrainian hacktivists | brief | SC MediaOpen source ↗

Bleeping ComputerNews · Oct 18, 2023

Ukrainian activists hack Trigona ransomware gang, wipe serversOpen source ↗

Bitdefender BlogNews · Dec 1, 2021

Ukrainian Cyber Alliance Disrupts Trigona Ransomware Operations, Exfiltrates Key DataOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Ukrainian Cyber Alliance Breaches Trigona Ransomware and Wipes Its Servers

How this story unfolded

Trigona public websites and services reported offline

UCA wipes and defaces Trigona servers, disrupting operations

UCA exfiltrates Trigona data including panels, source code, and wallets

Ukrainian Cyber Alliance exploits CVE-2023-22515 to access Trigona systems

Trigona targets exposed Microsoft SQL servers

Trigona brand becomes publicly identified

Trigona ransomware activity first observed in malware samples

Related entities

Threat actors

Malware

Sources

See the full picture, correlated to your attack surface.

Related stories

Trigona ransomware affiliates use custom exfiltration tool in renewed attacks

Trigona Ransomware Expands Attacks With HTA Notes and Multi-Stage Intrusions

CaddyWiper and Pseudo-Ransomware Wipers Hit Ukrainian Organizations

Ukrainian Cyber Alliance Breaches Trigona Ransomware and Wipes Its Servers

How this story unfolded

Trigona public websites and services reported offline

UCA wipes and defaces Trigona servers, disrupting operations

UCA exfiltrates Trigona data including panels, source code, and wallets

Ukrainian Cyber Alliance exploits CVE-2023-22515 to access Trigona systems

Trigona targets exposed Microsoft SQL servers

Trigona brand becomes publicly identified

Trigona ransomware activity first observed in malware samples

Related entities

Threat actors

Malware

Sources

See the full picture, correlated to your attack surface.

Related stories

Trigona ransomware affiliates use custom exfiltration tool in renewed attacks

Trigona Ransomware Expands Attacks With HTA Notes and Multi-Stage Intrusions

CaddyWiper and Pseudo-Ransomware Wipers Hit Ukrainian Organizations