HackerFeeds
All ransomware groups

trigona

49 tracked victims
·first seen 2023-04-11·last activity 2024-03-30

Group profile

According to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, it drops the how_to_decrypt.hta file that opens a ransom note. An example of how Trigona renames files: it renames 1.jpg to 1.jpg._locked, 2.png to 2.png._locked, and so forth.It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1190Exploit Public-Facing Application

TA0003

Persistence

  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

TA0005

Defense Evasion

  • T1036.005Masquerading: Match Legitimate Name or Location

  • T1140Deobfuscate/Decode Files or Information

  • T1218.005System Binary Proxy Execution: Mshta

  • T1497.003Virtualization/Sandbox Evasion: Time Based Checks

TA0006

Credential Access

TA0007

Discovery

  • T1033System Owner/User Discovery

  • T1083File and Directory Discovery

  • T1135Network Share Discovery

TA0040

Impact

  • T1485Data Destruction

  • T1486Data Encrypted for Impact

  • T1529System Shutdown/Reboot

Recent victims

DateWebsite / victimSectorCountry
2024-03-30Business ServicesMX
2024-03-20
south-star.com.cn
South Star Electronicssouth-star.com.cn/
TechnologyCN
2024-03-16Business ServicesID
2024-03-16HealthcarePT
2024-03-16
topa.co.nz
Topa Partnerstopa.co.nz/
ConstructionNZ
2024-02-21TechnologyUS
2024-02-28
dinamicoil.com
Dinamic Oildinamicoil.com
ManufacturingIT
2024-02-28Hospitality and TourismES
2024-01-25
americamovil.com
America Movilamericamovil.com
Business ServicesMX
2024-01-30TechnologyMX
2024-01-11ManufacturingES
2024-01-29ManufacturingAU
2024-01-30
cmgdrainage.com
CMG Drainage Engineeringcmgdrainage.com
Business ServicesUS
2024-01-30
dahercontracting.net
Daher Contractingdahercontracting.net/
Business ServicesUS
2024-01-25
jflommainc.com
Lomma Crane & Riggingjflommainc.com
Business ServicesUS
2024-01-18
samuel.co.id
Samuel Sekuritas Indonesia & Samuel Aset Manajemensamuel.co.id
Financial ServicesID
2024-01-18
pfmgreen.com
Premier Facility Managementpfmgreen.com
Business ServicesUS
2024-01-18
fertilitynorth.com.au
Fertility Northfertilitynorth.com.au
HealthcareAU
2024-01-18
V
Vision Plast
ManufacturingFR
2023-10-13
alconex.com
Alconex Specialty Productsalconex.com
Not Found
2023-10-12
F
FPZ
Not Found
2023-10-01
flamingoholland.nl
Flamingo Hollandflamingoholland.nl
Agriculture and Food ProductionNL
2023-10-01
A
Aria Care Partners
Healthcare
2023-10-01
P
Portesa
Agriculture and Food Production
2023-10-01
G
Grupo Boreal
Healthcare
2023-10-01
Q
Quest International
Business Services
2023-09-15
S
Steelforce
Manufacturing
2023-09-13
C
Cedar Holdings
Not Found
2023-09-05HealthcareBR
2023-09-05
cyberport.de
Cyberportcyberport.de
TechnologyDE
2023-06-06
phmc.org
Public Health Management Corporationphmc.org
Healthcare
2023-05-30
puc.edu
Pacific Union Collegepuc.edu
Education
2023-05-26
M
Marshall Construction Ltd
Construction
2023-05-25Technology
2023-05-22
T
Technology and Telecommunications Consultants Inc
Technology
2023-05-19Manufacturing
2023-05-18
L
Lolaico Impianti
ConstructionIT
2023-05-16
feit.com
Feit Electricfeit.com
ManufacturingUS
2023-05-15
A
Accudo Investments LTD
Financial ServicesGB
2023-05-13
T
TTCCPA
Financial Services
2023-05-11
A
Axiom Professional Solutions
Business Services
2023-05-09
F
Fresh Insurance IT Services
Financial Services
2023-04-18
T
Treadwell, Tamplin & Company, Certified Public Accountants, Madison, GA
Financial Services
2023-04-17Consumer ServicesOM
2023-04-17
wpc.com
Winter Park Constructionwpc.com
ConstructionUS
2023-04-11
A
Albany Clinic
HealthcareAU
2023-04-17
U
Unique Imaging
Healthcare
2023-04-17
mckinneytrailers.com
McKinney Trailersmckinneytrailers.com
ManufacturingUS
2023-04-17
O
Office Notarial de Baillargues
Business ServicesFR