Ransomware Gang Unveils Custom Data

Gbhackers •Mayura Kathir • April 24, 2026

Ransomware operators introduced a custom-built data exfiltration tool, signaling a notable evolution in attack techniques. Unlike most ransomware groups that rely on publicly available utilities such as Rclone or MegaSync, Trigona affiliates are now using a proprietary tool to steal sensitive data with greater precision and stealth. Trigona, active since late 2022, operates as a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Trigona Ransomware Group Deploys Custom Exfiltration Tool for Data Theft In March 2026, the Trigona ransomware group, which operates as a Ransomware-as-a-Service (RaaS), utilized a newly developed custom tool named 'uploader_client.exe' to enhance their data exfiltration capabilities. This tool allows for rapid and stealthy data theft, targeting high-value documents such as invoices and PDFs stored on network drives. The shift from commonly used utilities like Rclone and MegaSync to proprietary malware indicates a strategic move to avoid detection by security solutions. The attackers also employed the Huorong Network Security Suite tool HRSword to disable security measures on compromised systems, followed by the use of various other tools to facilitate credential theft and remote access. Notably, AnyDesk was used for remote access, while Mimikatz and Nirsoft tools were leveraged for credential harvesting. Despite disruptions to their operations in late 2023, Trigona affiliates have resumed attacks, indicating a persistent threat to organizations. Symantec has issued indicators of compromise (IoCs) to assist in detection and prevention efforts. 9 sources 71

Extracted Entities

Ransomware Gang Unveils Custom Data

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)

Tools (2)