#trigona — Public Fediverse posts on home.social

OTX Bot @[email protected] · 2026-05-05 · 05:35 UTC

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Pulse ID: 69f97a8dd96a037ffe45c661
Pulse Link: https://otx.alienvault.com/pulse/69f97a8dd96a037ffe45c661
Pulse Author: Tr1sa111
Created: 2026-05-05 05:05:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #DataTheft #InfoSec #OTX #OpenThreatExchange #RAT #Trigona #bot #Tr1sa111

#cybersecurity #datatheft #infosec #otx #openthreatexchange #rat

OTX Bot @[email protected] · 2026-05-04 · 14:32 UTC

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Trigona ransomware affiliates deployed a custom exfiltration tool called uploader_client.exe during attacks in March 2026, marking a tactical shift from relying on off-the-shelf utilities like Rclone. The tool features parallel streams with five default connections, connection rotation after 2,048 MB transfers to evade network monitoring, and granular filtering to exclude low-value files. Prior to exfiltration, attackers disabled security defenses using kernel-level tools including HRSword, PCHunter, Gmer, YDark, and WKTools with vulnerable drivers. Remote access was established via AnyDesk, while credentials were harvested using Mimikatz and Nirsoft utilities. The custom tooling demonstrates higher technical maturity compared to typical ransomware operations, providing enhanced stealth capabilities while requiring greater development resources. Targeted data included invoices and high-value PDF documents from networked drives.

Pulse ID: 69f4e8812c7240e62187fe72
Pulse Link: https://otx.alienvault.com/pulse/69f4e8812c7240e62187fe72
Pulse Author: AlienVault
Created: 2026-05-01 17:53:05

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AnyDesk #CyberSecurity #DataTheft #ELF #InfoSec #OTX #OpenThreatExchange #PDF #RAT #RCE #RansomWare #Rclone #Trigona #Word #bot #AlienVault

#anydesk #cybersecurity #datatheft #elf #infosec #otx

OTX Bot @[email protected] · 2026-04-27 · 05:09 UTC

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Pulse ID: 69eeecb940f0fd3a950e8d4d
Pulse Link: https://otx.alienvault.com/pulse/69eeecb940f0fd3a950e8d4d
Pulse Author: Tr1sa111
Created: 2026-04-27 04:57:29

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #DataTheft #InfoSec #OTX #OpenThreatExchange #RAT #Trigona #bot #Tr1sa111

#cybersecurity #datatheft #infosec #otx #openthreatexchange #rat

OTX Bot @[email protected] · 2026-04-24 · 09:35 UTC

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Trigona ransomware affiliates have adopted a custom-developed exfiltration tool called uploader_client.exe in attacks observed during March 2026, marking a significant tactical evolution. This command-line utility features parallel data streams, connection rotation to evade network monitoring, and granular file filtering capabilities. The shift from commonly used off-the-shelf tools like Rclone to proprietary malware suggests attackers are attempting to maintain a lower profile during critical attack phases. Prior to data exfiltration, attackers deploy multiple security-disabling tools including HRSword, PCHunter, and various BYOVD utilities to terminate endpoint protection at the kernel level. Remote access is established through AnyDesk, while credential theft is conducted using Mimikatz and Nirsoft utilities. This custom tooling approach demonstrates a higher degree of technical maturity compared to typical ransomware affiliate operations.

Pulse ID: 69ea2ebf9d87464f7c54c08e
Pulse Link: https://otx.alienvault.com/pulse/69ea2ebf9d87464f7c54c08e
Pulse Author: AlienVault
Created: 2026-04-23 14:37:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AnyDesk #CyberSecurity #DataTheft #ELF #Endpoint #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Rclone #Trigona #Word #bot #AlienVault