trigona

Executive Summary

Trigona is a medium-sophistication criminal threat actor primarily motivated by organizational gain, with goals of ransomware and financial gain. The actor has been active since 2023 and has targeted at least 49 victims, encrypting files and demanding ransom. Trigona's operations are characterized by the use of ransomware that appends the ._locked extension to filenames and drops a ransom note.

Goals & Targeting

Trigona's strategic objectives appear to be centered around achieving financial gain through the deployment of ransomware. The actor's targeting profile suggests a focus on organizations or individuals capable of paying significant ransoms, although the lack of specificity regarding targeted sectors and countries implies a potentially broad scope of operations. The typical victims of Trigona are likely those with valuable data and the financial resources to meet the actor's ransom demands, highlighting the need for organizations to prioritize robust cybersecurity measures and backup strategies to mitigate the impact of such attacks.

The lack of specific information on targeted sectors and countries suggests that Trigona may not be highly selective in its targeting, potentially indicating a more opportunistic approach. However, the focus on ransomware and financial gain implies that the actor is primarily interested in targeting organizations or individuals with the capability to pay significant ransoms. Given the medium level of sophistication attributed to Trigona, it is plausible that the actor continues to evolve and refine its tactics, potentially incorporating new techniques or tools into its operations.

Key Capabilities

• Ransomware development and deployment
• File encryption and decryption key management
• Ransom note creation and distribution
• Victim identification and tracking
• Data embedding within encrypted files

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Trigona's campaign patterns are characterized by the consistent use of ransomware to encrypt files and demand ransom. The actor's operational tempo is marked by a steady stream of attacks, with at least 49 known victims since the actor's first observed activity in 2023. Notable past operations include the deployment of ransomware with the ._locked extension and the use of HTA files for ransom notes. Given the medium level of sophistication, Trigona's operations may evolve to incorporate new tactics or tools, potentially increasing the actor's effectiveness and reach.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• Ransomware with the ._locked extension
• Use of HTA files for ransom notes

Recommended Actions

• Implement robust backup and disaster recovery strategies
• Utilize anti-ransomware solutions and endpoint protection
• Conduct regular security audits and vulnerability assessments
• Educate users on phishing and ransomware threats

Suggested Tags