Tag: trigona

3 Attack Reports | 0 Vulnerabilities

Attack reports

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Trigona ransomware affiliates deployed a custom exfiltration tool called uploader_client.exe during attacks in March 2026, marking a tactical shift from relying on off-the-shelf utilities like Rclone. The tool features parallel streams with five default connections, connection rotation after 2,048 …

trigona

ransomware-as-a-service

stpprocessmonitorbyovd

wktools

2026-05-01

Published: May 1, 2026

Downloadable IOCs: 42

Analysis of Trigona Threat Actor's Latest Attack Cases

The Trigona threat actor continues to target MS-SQL servers through brute-force and dictionary attacks, exploiting weak credentials. They use CLR Shell for additional payloads and employ various tools like BCP, Curl, Bitsadmin, and PowerShell to install malware. The attackers utilize remote control…

Published: October 29, 2025

Downloadable IOCs: 5

Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns

A team from security firm Sekoia has observed a series of attacks targeting vulnerable assets, including MS-SQL, and Mallox ransomware, using techniques similar to that of the PureCrypter ransomware.

Published: May 14, 2024

Downloadable IOCs: 10

Click here to see more Attack Reports