Malware

Trigona

According to PCrisk, Trigona is ransomware that encrypts files and appends the "._locked" extension to filenames. Also, it drops the "how_to_decrypt.hta" file that opens a ransom note. An example of how Trigona renames files: it renames "1.jpg" to "1.jpg._locked", "2.png" to "2.png._locked", and so forth. It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.

Indicators of Compromise 27

SHA-256 0ce7badb26174b6129fb13d7e255e582f84d8aaedeabcd02c80d84a609144e68 SHA-256 1588023393eb6b4d9433d539d303ecb56b6c3630e860f94d1a137834bdedf2bd SHA-256 207b11f7dc4f17e4e5a9c25dbfb6a785a7456d7c381ecea7c729d8d924be1fb9 SHA-256 274ca13168b38590c230bddc2d606bbe8c26de8a6d79156a6c7d07265efe0fdf SHA-256 2b214bddaab130c274de6204af6dba5aeec7433da99aa950022fa306421a6d32 SHA-256 396aa1f8f308010a3c76a53965d0eddd35e41176eacd1194745d9542239ca8dc SHA-256 4a44d0c6cf5de515dd296f05ff6674d1a340fccf6b4c11612d27be2d3baa82b0 SHA-256 4adbb1906762c757764ffc5fa64af96e091966f4f5a43aae12fcc4f05f1c26b5 SHA-256 5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd SHA-256 647b2f12486343fe065dc4abbb11e2338589eb099c72792b5a05e64a5e2937fc SHA-256 6688fb3039ad6df606d76a897ef1072cdc78b928335c6bfa691d99498caf5c4b SHA-256 6bac99f56e54d5195783513ae6954a4a8509d7bc397c94f405266b5df9cd96cb SHA-256 6ce228240458563d73c1c3cbbd04ef15cb7c5badacc78ce331848f5431b406cc SHA-256 73cd405b5bfc99ec5cf33467d4be7fc7e39ae18337568ee10173c17ba6e8f0d7 SHA-256 771de264c5d7e1e5ac85f00c42e9fe3b439bcbd4f9aa11e4fd7bc0d87fa2344e SHA-256 87bf4b152d9548f415f12f353f988b5442729e7f24e2902ddfd0baa4a944354a SHA-256 8a2f4907159a68867b22bc772590ebcafcfa656a23951228ecd89e4f598472b0 SHA-256 b066ca2702853c2fcbf686897c18f6d315be7ae753007ac2c1d73c87b0a30de9 SHA-256 b3774ba01a3096348fd76a7072407b9f07bb9589e0f5ba31ca576689bbbe94e4 SHA-256 c41216eee9756a1dcc546df4fe97defc05513eed64ce6ac05f1501b50e6f96cc SHA-256 c64964944b4c1f649ae8f694964b3a212dc1028341ab71836306a456fba0b3f4 SHA-256 d4339a5b9d15211dbc85424cf7fa8ff825033ea3378506d8ecb19b016db5b4ff SHA-256 df5a574254637d2880633b0582e956b23f66efc6781e825c65e1ccfaa6c58809 SHA-256 e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173 SHA-256 eee885e5dae750848d0903d179cacd81149ceecec83c2ec4ad4545531de3cfdf SHA-256 f27eab3157451e31db71169e71f76d28325193218f9dc8f421136d4a20165feb IP 163[.]172[.]105[.]82

MITRE ATT&CK TTPs 1

T1055

Process Injection

Defense Evasion

Source Articles

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Trigona ransomware affiliates have deployed a custom exfiltration tool, uploader_client.exe, in attacks observed in March 2026, marking a shift from using common tools like Rclone to proprietary malware for greater control and stealth. The custom tool enables parallel data streams, connection rotation to evade detection, granular file filtering, and uses a shared key for authentication with the attacker-controlled server. Prior to data exfiltration, attackers disable security software using kernel-level tools such as HRSword, PCHunter, Gmer, and others, often leveraging vulnerable drivers (BYOVD technique), and gain remote access via AnyDesk. Credential theft is conducted using Mimikatz and Nirsoft tools.

security-com ·3mo ago