Skip to main content
Ransomware Group

Trigona

According to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, it drops the how_to_decrypt.hta file that opens a ransom note. An example of how Trigona renames files: it renames 1.jpg to 1.jpg._locked, 2.png to 2.png._locked, and so forth.It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.

Known victims49

Threat level

MEDIUM

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • Mimikatz

DiscoveryEnum

  • Advanced Port Scanner
  • SoftPerfect NetScan

Exfiltration

  • MEGA
  • RClone

Offsec

  • Cobalt Strike

RMM-Tools

  • AnyDesk
  • LogMeIn
  • ScreenConnect
  • Splashtop
  • TeamViewer

Known infrastructure

The following Tor hidden services have been associated with this group:

  • Trigona is Gone
  • Trigona is Gone
  • Blog
  • Blog

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on Trigona’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida