MalwarePublished 23 Apr 2026

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Source AlienVault OTX General

Description

Trigona ransomware affiliates have developed and deployed a custom exfiltration tool named uploader_client.exe, observed in attacks during March 2026. This tool uses parallel data streams, connection rotation, and file filtering to evade detection and streamline data theft. Attackers disable endpoint protections at the kernel level using multiple utilities before exfiltration. Remote access and credential theft are facilitated by AnyDesk and tools like Mimikatz. This represents a more technically sophisticated approach than typical ransomware affiliate operations.

Impact

The use of custom exfiltration tooling combined with kernel-level disabling of endpoint protections increases the likelihood of successful data theft and persistence within targeted environments. The attackers' ability to evade network monitoring and disable security controls can lead to significant data breaches and complicate incident response efforts. Credential theft and remote access further enable lateral movement and prolonged access. However, no known exploits in the wild or specific vulnerabilities are indicated.

Defensive guidance

Organizations should focus on detecting and blocking the use of known tools such as uploader_client.exe, HRSword, PCHunter, and AnyDesk in unauthorized contexts. Endpoint detection and response solutions should be tuned to identify kernel-level tampering and unusual network connections. Credential theft prevention measures, including multi-factor authentication and credential vaulting, are recommended. Since this is a malware campaign rather than a software flaw, vendor patching does not apply.

Summary

The Trigona ransomware affiliate group has introduced a proprietary exfiltration tool, uploader_client.exe, to replace common off-the-shelf utilities such as Rclone. This command-line tool supports parallel data streams, connection rotation to avoid network monitoring, and granular file filtering, enhancing stealth and efficiency in data theft. Prior to exfiltration, attackers deploy kernel-level security-disabling tools including HRSword, PCHunter, and BYOVD utilities to terminate endpoint protection mechanisms. Remote access is maintained via AnyDesk, while credential harvesting is conducted using Mimikatz and Nirsoft utilities. This custom tooling indicates a higher technical maturity and operational security focus within the Trigona affiliate operations.

Indicators of compromise

Hashes 64

e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173
816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019
7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26
598555a7e053c7456ee8a06a892309386e69d473c73284de9bbc0ba73b17e70a
746710470586076bb0757e0b3875de9c90202be2
2b214bddaab130c274de6204af6dba5aeec7433da99aa950022fa306421a6d32
205818e10c13d2e51b4c0196ca30111276ca1107fc8e25a0992fe67879eab964
1dfe0e65f3fb60ee4e46cf8125ad67ca
fae1061813f2148296767d28262d2c25
c7d994eb2042633172bd8866c9f163be531444ce3126d5f340edd25cbdb473d4

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 May 2026, 01:36 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Hashes 64

Community reviews

Related threats