Trigona Ransomware Affiliates Deploy Custom Exfiltration Tool 'TriStealer' for Pre-Ransomware Data Theft — Threadlinqs Intelligence
As of 2026-05-30, Trigona Ransomware Affiliates Deploy Custom Exfiltration Tool 'TriStealer' for Pre-Ransomware Data Theft is a high-severity malware threat attributed to Trigona Ransomware Affiliates (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0414 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Trigona Ransomware Affiliates · Russia · FINANCIAL
Broadcom/Symantec Threat Hunter Team has observed Trigona ransomware affiliates deploying a custom-built exfiltration utility, tracked as 'TriStealer', during the pre-encryption staging phase of
On 2026-04-22 Broadcom/Symantec's Threat Hunter Team published an analysis of recent Trigona ransomware intrusions showing a clear tactical shift: Trigona affiliates have begun deploying a custom-developed data exfiltration tool — internally referred to as 'TriStealer' by researchers — in the pre-ransomware staging phase instead of the commodity utilities (Rclone, MEGAsync, FileZilla) historically favoured by the group. Symantec's telemetry across multiple intrusions in North America and Western Europe between February and April 2026 confirms consistent use of the new tooling by at least two Trigona affiliates.
TriStealer is a 64-bit Windows PE written in Go, packed with a custom compiler-time obfuscator that randomises string tables and control-flow on each build. Observed samples are typically 4.8-6.2 MB, statically linked, and signed with short-lived Sectigo and Certum code-signing certificates issued to shell companies — a signing abuse pattern consistent with other ransomware affiliate programs (LockBit, BlackCat). The tool is staged by the operator after initial access and privilege escalation, most commonly dropped into C:\Users\Public\Libraries\wsuscli.exe, C:\ProgramData\Microsoft\NetFramework
fx_sync.exe, or %APPDATA%\Local\Temp\onedrive_agent.exe to blend with legitimate file names.
On execution, TriStealer enumerates mapped drives, SMB shares, and specific high-value folder patterns (Finance, HR, Legal, Engineering, Backup, customers, contracts) using WinAPI FindFirstFileW/FindNextFileW. File collection is tuned: Office documents (.docx, .xlsx, .pptx), PDFs, CAD drawings (.dwg, .step), source code archives, and database dumps (.bak, .mdf, .sql, .dmp) are prioritised while anything under 2 KB or above 5 GB is skipped by default. Collected files are written to AES-256-GCM encrypted per-archive .tsa files (TriStealer Archive) in C:\ProgramData\Microsoft\DRM\ with a per-campaign hard-coded key derived at compile time.
Once archives reach a configurable size threshold (default 256 MB), TriStealer beacons to one of three embedded HTTPS endpoints using a rotating User-Agent and domain-fronted through Cloudflare and Fastly to make C2 blocking harder. Exfiltration uses HTTP/2 PUT requests with the archive chunked at 16 MB, and each request carries a custom 'X-TS-Id' header whose value is an HMAC-SHA256 of (campaign_id || chunk_id). After successful exfiltration the tool wipes local archives and inserts an alternate data stream (ADS) marker on the host to signal the ransomware deployment stage to the affiliate's encryption loader.
This TTP shift matters because (1) Rclone/MEGAsync signatures and configuration-file artefacts — which many EDRs and SIEM rules rely on for pre-encryption exfil detection — are entirely absent; (2) the custom archive format defeats DLP rules that key on known cloud-storage protocols; and (3) the dual-certificate signing complicates reputation-based blocking. Enterprises that previously relied on Rclone/MEGAsync detections as their primary pre-ransomware tripwire should expect a detection gap against Trigona intrusions until behavioural and network-pattern detections are deployed.
Symantec links TriStealer usage to Trigona affiliates with medium-to-high confidence based on (a) post-intrusion deployment of the Trigona ransomware encryptor on the same hosts within 6-36 hours of TriStealer execution, (b) reuse of TTPs established in prior Trigona playbooks (SplashTop/AnyDesk for persistence, Mimikatz + LSASS dumping for credential access, Cobalt Strike for lateral movement), and (c) overlap in the C2 infrastructure previously seen in 2025 Trigona incidents.
Weaknesses (CWE)
CWE-732, CWE-284, CWE-200
Target sectors: manufacturing, healthcare, financial, legal, technology, construction, logistics
Target regions: North America, Western Europe, Australia, Japan
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1133, T1078, T1059, T1204, T1219, T1053, T1548, T1027, T1553, T1036