Trigona Ransomware Expands Attacks With HTA Notes and Multi-Stage Intrusions

Trigona ransomware hit at least 15 organizations across manufacturing, finance, construction, agriculture, marketing, and high technology, with activity accelerating after its emergence in late 2022. The malware drops an unusual HTML Application ransom note, how_to_decrypt.hta, which contains embedded JavaScript, victim-specific identifiers, contact emails, and a Tor-based negotiation portal. Trigona encrypts files using Delphi AES functionality, appends the ._locked extension, and has been linked to leak-site infrastructure used to pressure victims.

Investigators observed operators using NetScan, Splashtop, Mimikatz, Advanced Port Scanner, and batch scripts to conduct reconnaissance, steal credentials, move laterally, evade defenses, and clean up traces of activity. The intrusion set also established persistence through Windows CurrentVersion\Run registry keys, aligning with common persistence tradecraft such as MITRE ATT&CK T1136 Create Account in broader enterprise environments. Researchers also noted overlaps with BlackCat leak posts and CryLock tradecraft, indicating possible operational links or an evolution of earlier ransomware activity.