Trigona Ransomware Deploys Custom CLI Exfiltration Tool in Active Attacks

Attack Overview

The Trigona ransomware group — a threat actor that has targeted organizations across finance, manufacturing, and healthcare — has been observed deploying a custom-built command-line exfiltration tool in recent attacks. The specialized utility enables Trigona operators to steal data from compromised environments at significantly higher speed and efficiency compared to general-purpose file transfer methods previously used by the group.

Security researchers tracking the campaign note the tool represents a maturation of Trigona's operational tradecraft, suggesting the group is investing in bespoke tooling to improve their double-extortion capabilities.

What Is Trigona Ransomware?

Trigona is a ransomware-as-a-service (RaaS) operation that encrypts victim files and demands ransom payments in Monero (XMR) cryptocurrency. The group first emerged in late 2022 and has been linked to attacks on organizations across multiple continents.

Trigona operates under the double-extortion model: in addition to encrypting files, operators exfiltrate sensitive data before encryption and threaten to publish it on their dark web leak site if victims refuse to pay. Effective data exfiltration is therefore central to Trigona's business model — making investment in specialized tooling a logical operational evolution.

The Custom Exfiltration Tool

Overview

Unlike many ransomware operators who rely on general-purpose tools like rclone, WinSCP, MEGAcmd, or PowerShell scripts for data theft, Trigona has developed a purpose-built command-line utility specifically designed for exfiltration operations.

Key characteristics of the tool observed in recent attacks:

How It Works

The tool operates post-compromise, after Trigona affiliates have gained initial access and achieved sufficient lateral movement to reach high-value data stores. The exfiltration utility:

1. Enumerates file systems — scanning for high-value file types including documents, spreadsheets, databases, source code, and credential stores
2. Selectively packages data — prioritizing files likely to have maximum extortion leverage (financial records, PII, intellectual property, emails)
3. Transfers to attacker-controlled infrastructure — exfiltrating the packaged data to C2 servers using protocols less likely to trigger network monitoring alerts
4. Operates efficiently at scale — enabling exfiltration of large data volumes within the attack window before encryption begins

Operational Significance

The development of custom exfiltration tooling signals several things about Trigona's current capabilities:

• Increased operational sophistication — purpose-built tools indicate dedicated development resources
• Awareness of enterprise defenses — the tool is designed with detection evasion in mind, reflecting knowledge of common DLP and EDR signatures
• Higher exfiltration success rates — custom tooling enables theft of more data in less time, strengthening extortion leverage

Indicators of Compromise (IoCs)

Organizations investigating potential Trigona infections should look for:

• Unusual outbound data transfers, particularly to cloud storage providers or unknown IP ranges
• New CLI binaries dropped in temporary directories (%TEMP%, /tmp, staging directories)
• Scheduled tasks or cron jobs invoking unfamiliar executables
• Large-scale file enumeration activity prior to encryption events
• Network connections to known Trigona C2 infrastructure (consult threat intelligence feeds for current IoCs)

Trigona's Targeting Profile

Trigona has historically targeted:

• Financial services — banks, insurance companies, payment processors
• Manufacturing — industrial companies with sensitive IP and operational data
• Healthcare — hospitals and healthcare providers with high-value patient data
• Agriculture — a less common but documented targeting sector

The group typically gains initial access through exposed RDP services, phishing emails, and exploiting known vulnerabilities in internet-facing systems.

Defensive Recommendations

Immediate Actions

1. Monitor for large-scale outbound data transfers — alert on unusual volumes of data leaving your network, particularly to unfamiliar destinations.
2. Enable DLP policies targeting sensitive file types (financial documents, PII, source code, credentials).
3. Audit exposed services — ensure RDP, VPNs, and other remote access services are not exposed to the internet without MFA.
4. Patch known vulnerabilities — Trigona affiliates exploit known CVEs for initial access; maintain up-to-date patching.

Defense in Depth

• Segment your network — limit lateral movement opportunities; high-value data stores should not be directly reachable from internet-facing systems.
• Implement backup isolation — maintain offline, immutable backups that cannot be reached by ransomware operators during an attack.
• Deploy behavior-based EDR — signature-based detection alone is insufficient against custom tooling; behavioral analysis is required to catch novel exfiltration utilities.
• Monitor privileged account activity — Trigona operators abuse legitimate admin tools and accounts; alert on anomalous privileged operations.

Incident Response Preparation

• Ensure your IR plan covers ransomware scenarios including pre-encryption data theft.
• Establish relationships with forensic IR vendors before an incident.
• Know your regulatory notification obligations — exfiltration of PII or health data triggers breach notification requirements independent of whether ransom is paid.

Broader Context: Custom Tooling Trend

Trigona's custom exfiltration tool is part of a broader trend among sophisticated ransomware groups investing in bespoke operational tooling:

• LockBit developed custom data exfiltration capabilities built into its encryptor
• BlackCat/ALPHV used custom exfiltration tools alongside its Rust-based encryptor
• Cl0p developed the LEMURLOOT webshell and DEWMODE file-stealing tool for MOVEit exploitation

As enterprise defenses improve, ransomware operators respond by developing tooling that evades the specific controls defenders deploy. This arms race dynamic means that relying on static detection signatures is insufficient — behavioral detection, network monitoring, and zero-trust architecture are increasingly essential components of a complete ransomware defense strategy.

References

• BleepingComputer — Trigona ransomware attacks use custom exfiltration tool to steal data
• CISA — StopRansomware Resources