Loading malware…
Trigona is a ransomware family and ransomware-as-a-service operation first observed in 2022, with public branding emerging in late 2022 and earlier samples dating back to mid-2022. It targets both Windows and Linux environments, including VMware ESXi-related Linux deployments, and has been associated with double-extortion activity in which data is stolen before encryption and victims are pressured through leak and negotiation portals. Security reporting has linked operation of the service to a cybercrime group tracked by some researchers as Rhantus.
Trigona encrypts victim files and commonly appends the ._locked extension. Windows samples have been described as Delphi-based and use AES together with embedded or encrypted configuration data. Variants support extensive command-line control over encryption scope, debugging, persistence, and destructive actions. Reported behaviors include partial or full-file encryption, filename encryption, ransom-note deployment, autorun persistence, deletion of shadow copies and backups, disabling recovery options, and in some variants file erasure or free-space wiping. Linux variants expose similar functionality and have been observed supporting options for path selection, fast versus full encryption, optional command execution, task and service termination, self-deletion, and ESXi virtual machine disruption through powering off guest systems before encryption.
Observed intrusions show Trigona operators and affiliates using multiple access paths. High-confidence reporting ties the group to compromises of externally exposed Microsoft SQL Server systems with weak credentials, including brute-force or dictionary attacks and abuse of SQL Server features and utilities to stage payloads. Trigona has also been reported exploiting CVE-2021-40539 in ManageEngine products for initial access, and separate incident reporting has documented deployment following compromise of publicly exposed RDP services using valid accounts. In SQL Server-focused cases, attackers used CLR-based SQL shell tooling, the Bulk Copy Program utility, and supporting malware to reconstruct or launch payloads on compromised hosts.
Post-compromise tradecraft includes reconnaissance, credential theft, lateral movement, persistence, and defense evasion. Reported tooling and behaviors include Mimikatz, Nirsoft password recovery tools, AnyDesk, Splashtop, network and port scanners, batch-script automation, creation of privileged local accounts, disabling or terminating security products, and use of vulnerable drivers to kill endpoint protections. Recent reporting from 2026 indicates Trigona affiliates shifted from common public exfiltration utilities to a custom command-line uploader designed for faster and stealthier theft of selected high-value documents, suggesting continued investment in proprietary tooling.
Victimology has included organizations in technology, healthcare, manufacturing, finance, construction, agriculture, marketing, and high-technology sectors across multiple countries. Trigona infrastructure was disrupted in 2023 by Ukrainian hacktivists, but subsequent reporting indicates the malware family and affiliated activity continued after that event, including later Windows and Linux samples and renewed exfiltration-focused intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Trigona ransomware is a relatively new ransomware family that began activities around late October 2022 — although samples of it existed as early as June 2022.
Exploitation of a critical Confluence Data Center and Server vulnerability, tracked as CVE-2023-22515, enabled UCA hacktivists to infiltrate Trigona's ransomware infrastructure last week without being detected by the ransomware group.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Trigona ransomware is a relatively new ransomware family that began activities around late October 2022 — although samples of it existed as early as June 2022.
Trigona ransomware was first observed in June 2022. It has Windows and Linux versions, which are similar in their functionality. On underground forums, threat actors announced the start of the affiliate program, meaning that Trigona operates as ransomware as a service.
Trigona ransomware now uses a custom command-line tool to steal data faster and evade detection, replacing tools like Rclone and MegaSync.
In January 2024, the group first made its mark by deploying Trigona and Mimic ransomware on MS-SQL servers exposed to the internet with weak credentials.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Based on AhnLab’s analysis, Trigona’s operators use CLR shell on attacks launched against MS-SQL servers.
The output code shows that the malware is able to issue Virtual Infrastructure Management commands to a VMWare ESXi server. It lists all VMs, and then kills them all. ... command = "vim-cmd vmsvc/getallvms"; ... snprintf(poweroff_cmd, sizeof(poweroff_cmd), "vim-cmd vmsvc/power.off %s", vmid); ret = shellExecute(poweroff_cmd, &command, true);
This tool is capable of multiple commands, including one that drops additional executables for privilege escalation (nt.exe).
“Trigona… change in tactics designed to hide its identity… ransom notes avoid mentioning [their leak site]… point to leak sites belonging to other ransomware groups…”
/* * The /delete option enables deletion mode in the program. * When this flag is set, instead of just scanning or analyzing files, * the program will actually remove files that match certain criteria. * ... */ bool process_command_options(const char* option) { ... if (strcmp(option, "/delete") == 0) { ... *g_deletion_enabled = true;
Trigona’s operators employ the credential dumper Mimikatz to gather the passwords and credentials found on the machines of the victims.
The commands that the threat actor first executes before creating the malware with BCP... are those that look up the infected system’s information as shown below. > hostname > whoami
It also uses Network Scanner and Advanced Port Scanner to identify network connections.
The output code shows that the malware is able to issue Virtual Infrastructure Management commands to a VMWare ESXi server. It lists all VMs, and then kills them all. ... command = "vim-cmd vmsvc/getallvms";
While many ransomware groups rely on off-the-shelf utilities such as Rclone or MegaSync to steal victim data, recent attacks involving the Trigona ransomware used a custom-developed tool designed to provide attackers with granular control over the data theft process.
This site hosts critical data stolen from victims such as documents, contracts, and other large amounts of data.
Deletes the content of the target files. (By default, only the first 512kb is erased unless the argument /full is used)
Trigona encrypts files in infected machines using AES encryption.
// Power off ESXi VMs if needed if (targetPath == "/vmfs/" && doPowerOff) { ... stopVM(); } ... The output code shows that the malware is able to issue Virtual Infrastructure Management commands to a VMWare ESXi server. It lists all VMs, and then kills them all. | // Kill processes if not disabled if (getTaskKillerEnabled() && !disableKillFlag) { killTasksAndServices(); }
// Shutdown system if requested if (shutdownAfterFlag) { reboot(0x4321FEDC); // Special reboot code }
// Perform encryption or erasing priorityEncryptionOrErasing(); writeToLog("Start process..."); // Process target path String normalizedPath = osConvertSlashToBackslash(targetPath); if (fileExists(normalizedPath)) { encryptOrEraseFileByPath(targetPath, false); } else { encryptOrEraseFolderByPath(targetPath, false); }
101 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Trigona is mentioned only as prior context linking SqlShell to another ransomware-related MS-SQL compromise.
A ransomware-as-a-service operation active since late 2022, linked in the content to the Rhantus cybercrime group. Recent attacks used a custom-built exfiltration utility (uploader_client.exe) to steal sensitive data more efficiently and evade detection, alongside credential theft and security-disabling tools.
Ransomware-as-a-service malware that targets Windows and Linux systems, encrypts files with the ._locked extension, and uses double-extortion tactics including data exfiltration prior to encryption.
A ransomware family operating as a Ransomware-as-a-Service platform. In the described campaign, affiliates used a custom exfiltration utility to steal targeted financial and document data prior to ransomware activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.