Loading story…
Trigona ransomware hit at least 15 organizations across manufacturing, finance, construction, agriculture, marketing, and high technology, with activity accelerating after its emergence in late 2022. The malware drops an unusual HTML Application ransom note, how_to_decrypt.hta, which contains embedded JavaScript, victim-specific identifiers, contact emails, and a Tor-based negotiation portal. Trigona encrypts files using Delphi AES functionality, appends the ._locked extension, and has been linked to leak-site infrastructure used to pressure victims.
Investigators observed operators using NetScan, Splashtop, Mimikatz, Advanced Port Scanner, and batch scripts to conduct reconnaissance, steal credentials, move laterally, evade defenses, and clean up traces of activity. The intrusion set also established persistence through Windows CurrentVersion\Run registry keys, aligning with common persistence tradecraft such as MITRE ATT&CK T1136 Create Account in broader enterprise environments. Researchers also noted overlaps with BlackCat leak posts and CryLock tradecraft, indicating possible operational links or an evolution of earlier ransomware activity.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The "Trigona Leaks" web server hosted at 45.227.253.106 remained active until March 3, 2023, when its observed hosting period ended.
On February 13, 2023, IP address 45.227.253.106 began hosting a web server titled "Trigona Leaks," which Unit 42 assessed was likely a leak site tied to the ransomware operation.
Unit 42 identified two more Trigona ransom notes in February 2023, further documenting ongoing Trigona activity.
Unit 42 identified two new Trigona ransom notes in January 2023, indicating continued victimization activity.
Unit 42 determined that Trigona was very active during December 2022 and identified at least 15 potential victims compromised that month across multiple sectors and countries.
Security researchers first discovered the Trigona ransomware strain in late October 2022.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that **Trigona** ransomware affiliates used a custom-built data theft utility, `uploader_client.exe`, in recent intrusions, replacing common exfiltration tools such as Rclone and MegaSync. The command-line tool connected to a hardcoded attacker-controlled server and was designed to steal high-value files from network drives, including invoices and PDFs, while lowering detection risk. Reported capabilities included parallel upload streams, TCP connection rotation after large transfers, file-extension filtering, and shared-key authentication, indicating a more mature and deliberate approach to exfiltration by affiliates tied to the **Rhantus** ransomware-as-a-service operation. The attacks also involved a broader toolset to weaken defenses and expand access before data theft. Investigators said the actors attempted to disable security controls with utilities including **HRSword**, **PCHunter**, **Gmer**, **YDark**, **WKTools**, **DumpGuard**, and **StpProcessMonitorByovd**, often abusing vulnerable kernel drivers and using **PowerRun** for elevated execution. They then used **AnyDesk** for remote access and **Mimikatz** plus Nirsoft password recovery tools for credential theft. The activity suggests Trigona, which had lower visibility after disruption in 2023, has remained active and resumed operations with more customized and stealthy tradecraft.
Jun 29, 2026
The **Ukrainian Cyber Alliance (UCA)** said it breached the Trigona ransomware gang’s infrastructure, exfiltrated internal data, and wiped and defaced servers, knocking the group’s public-facing services offline. According to reports, the activists gained initial access by exploiting **`CVE-2023-22515`**, a critical vulnerability in **Atlassian Confluence Data Center and Server**, then remained undetected while mapping Trigona’s environment and extracting data from administration and victim panels, internal tools, source code repositories, databases, developer systems, leak-site infrastructure, and cryptocurrency hot wallets. The stolen data reportedly included **hundreds of gigabytes** of backups and documents, and may also contain **decryption keys** that could aid victims. Trigona, a ransomware operation active since 2022, had targeted organizations in sectors including manufacturing and finance and had previously used exposed **Microsoft SQL servers** as an intrusion vector. Following the intrusion, Trigona’s websites and operational services were reported offline, with UCA claiming the action effectively dismantled the gang’s infrastructure.
Jun 29, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026