security-com · Crawled Jul 31, 2026

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

27 IoCs 2 Malware
Read original article ↗

AI Summary

Trigona ransomware affiliates have deployed a custom exfiltration tool, uploader_client.exe, in attacks observed in March 2026, marking a shift from using common tools like Rclone to proprietary malware for greater control and stealth. The custom tool enables parallel data streams, connection rotation to evade detection, granular file filtering, and uses a shared key for authentication with the attacker-controlled server. Prior to data exfiltration, attackers disable security software using kernel-level tools such as HRSword, PCHunter, Gmer, and others, often leveraging vulnerable drivers (BYOVD technique), and gain remote access via AnyDesk. Credential theft is conducted using Mimikatz and Nirsoft tools.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware Trigona → Malware MimiKatz →

Indicators of Compromise 27 extracted

Type Value Detail
SHA-256 396aa1f8f308010a3c76a53965d0eddd35e41176eacd1194745d9542239ca8dc Details →
SHA-256 6ce228240458563d73c1c3cbbd04ef15cb7c5badacc78ce331848f5431b406cc Details →
SHA-256 0ce7badb26174b6129fb13d7e255e582f84d8aaedeabcd02c80d84a609144e68 Details →
SHA-256 1588023393eb6b4d9433d539d303ecb56b6c3630e860f94d1a137834bdedf2bd Details →
SHA-256 207b11f7dc4f17e4e5a9c25dbfb6a785a7456d7c381ecea7c729d8d924be1fb9 Details →
SHA-256 274ca13168b38590c230bddc2d606bbe8c26de8a6d79156a6c7d07265efe0fdf Details →
SHA-256 2b214bddaab130c274de6204af6dba5aeec7433da99aa950022fa306421a6d32 Details →
SHA-256 4a44d0c6cf5de515dd296f05ff6674d1a340fccf6b4c11612d27be2d3baa82b0 Details →
SHA-256 4adbb1906762c757764ffc5fa64af96e091966f4f5a43aae12fcc4f05f1c26b5 Details →
SHA-256 6688fb3039ad6df606d76a897ef1072cdc78b928335c6bfa691d99498caf5c4b Details →
SHA-256 5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd Details →
SHA-256 6bac99f56e54d5195783513ae6954a4a8509d7bc397c94f405266b5df9cd96cb Details →
SHA-256 771de264c5d7e1e5ac85f00c42e9fe3b439bcbd4f9aa11e4fd7bc0d87fa2344e Details →
SHA-256 73cd405b5bfc99ec5cf33467d4be7fc7e39ae18337568ee10173c17ba6e8f0d7 Details →
SHA-256 87bf4b152d9548f415f12f353f988b5442729e7f24e2902ddfd0baa4a944354a Details →
SHA-256 8a2f4907159a68867b22bc772590ebcafcfa656a23951228ecd89e4f598472b0 Details →
SHA-256 b066ca2702853c2fcbf686897c18f6d315be7ae753007ac2c1d73c87b0a30de9 Details →
SHA-256 b3774ba01a3096348fd76a7072407b9f07bb9589e0f5ba31ca576689bbbe94e4 Details →
SHA-256 c41216eee9756a1dcc546df4fe97defc05513eed64ce6ac05f1501b50e6f96cc Details →
SHA-256 c64964944b4c1f649ae8f694964b3a212dc1028341ab71836306a456fba0b3f4 Details →
SHA-256 d4339a5b9d15211dbc85424cf7fa8ff825033ea3378506d8ecb19b016db5b4ff Details →
SHA-256 df5a574254637d2880633b0582e956b23f66efc6781e825c65e1ccfaa6c58809 Details →
SHA-256 e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173 Details →
SHA-256 eee885e5dae750848d0903d179cacd81149ceecec83c2ec4ad4545531de3cfdf Details →
SHA-256 f27eab3157451e31db71169e71f76d28325193218f9dc8f421136d4a20165feb Details →
SHA-256 647b2f12486343fe065dc4abbb11e2338589eb099c72792b5a05e64a5e2937fc Details →
IP 163[.]172[.]105[.]82 Details →

MITRE ATT&CK TTPs 72 techniques

T1055 Process Injection · Defense Evasion T1001.001 Junk Data · Command And Control T1003 OS Credential Dumping · Credential Access T1003.001 LSASS Memory · Credential Access T1003.002 Security Account Manager · Credential Access T1018 Remote System Discovery · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1033 System Owner/User Discovery · Discovery T1046 Network Service Discovery · Discovery T1048 Exfiltration Over Alternative Protocol · Exfiltration T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol · Exfiltration T1053 Scheduled Task/Job · Execution T1053.005 Scheduled Task · Execution T1055.003 Thread Execution Hijacking · Defense Evasion T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1074 Data Staged · Collection T1074.001 Local Data Staging · Collection T1078 Valid Accounts · Defense Evasion T1078.001 Default Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1086 T1086 T1087.001 Local Account · Discovery T1087.002 Domain Account · Discovery T1090.001 Internal Proxy · Command And Control T1090.003 Multi-hop Proxy · Command And Control T1098 Account Manipulation · Persistence T1098.001 Additional Cloud Credentials · Persistence T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1110.003 Password Spraying · Credential Access T1112 Modify Registry · Defense Evasion T1114 Email Collection · Collection T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1212 Exploitation for Credential Access · Credential Access T1222 File and Directory Permissions Modification · Defense Evasion T1222.001 Windows File and Directory Permissions Modification · Defense Evasion T1482 Domain Trust Discovery · Discovery T1484 Domain or Tenant Policy Modification · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1489 Service Stop · Impact T1490 Inhibit System Recovery · Impact T1537 Transfer Data to Cloud Account · Exfiltration T1543.003 Windows Service · Persistence T1547.001 Registry Run Keys / Startup Folder · Persistence T1558.003 Kerberoasting · Credential Access T1562.001 Disable or Modify Tools · Defense Evasion T1566 Phishing · Initial Access T1569.002 Service Execution · Execution T1570 Lateral Tool Transfer · Lateral Movement T1571 Non-Standard Port · Command And Control T1572 Protocol Tunneling · Command And Control T1573 Encrypted Channel · Command And Control T1573.001 Symmetric Cryptography · Command And Control T1574 Hijack Execution Flow · Persistence T1589 Gather Victim Identity Information · Reconnaissance T1614 System Location Discovery · Discovery