Loading threat actor…
Rhantus is a cybercrime group associated with operating the Trigona ransomware-as-a-service ecosystem, active since late 2022. The group is linked to ransomware intrusions that combine data theft, credential harvesting, remote access, defense evasion, and ransomware deployment. Trigona activity attributed to Rhantus has shown continued operational development, including the use of proprietary tooling for exfiltration rather than relying solely on common public utilities. Observed Rhantus-linked tradecraft includes targeted theft of high-value documents from network-accessible storage, with particular focus on business-relevant files such as invoices and PDF documents. In 2026, Trigona affiliates associated with Rhantus were reported using a custom command-line exfiltration utility designed to improve transfer speed, selectively exclude lower-value files, and reduce detection through connection management and authenticated uploads. This indicates investment in bespoke tooling and a comparatively mature operational model for a ransomware affiliate ecosystem. Intrusions linked to Rhantus have also involved extensive defense evasion and post-compromise tooling. Operators or affiliates were observed disabling security products with utilities such as HRSword, PCHunter, GMER, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd, including bring-your-own-vulnerable-driver techniques to terminate endpoint protections. They used PowerRun for elevated execution, AnyDesk for remote access, and credential theft tools including Mimikatz and Nirsoft password recovery utilities to harvest credentials from browsers and applications. Overall, Rhantus is best characterized as a financially motivated ransomware operator behind Trigona, with capabilities spanning credential theft, defense evasion, privileged execution, remote access, exfiltration, and broader post-exploitation activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
43 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercrime group explicitly linked in the content to the Trigona ransomware operation.
Named as the cybercrime group managing the Trigona RaaS operation.
Operates the Trigona ransomware as a RaaS operation and, in March 2026 attacks, used a custom-developed data exfiltration tool along with defense impairment, remote access, and credential theft tooling.
A cybercrime group identified by Symantec as the operator behind the Trigona ransomware-as-a-service operation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.