Trigona Ransomware Affiliates Deploy Custom Exfiltration Tool 'TriStealer' for Pre-Ransomware Data Theft
Trigona Ransomware Affiliates Deploy Custom Exfiltration (TL-2026-0414), also tracked as TriStealer Campaign, is a high-severity malware campaign, first published 2026-04-23. It is attributed to Trigona Ransomware Affiliates (Russia) with medium confidence, affects Microsoft Windows (endpoints and servers), maps to 27 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0414
- Threat ID
- TL-2026-0414
- Also known as
- TriStealer Campaign, Trigona Exfil Wave 2026-Q2
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-23
- Last reviewed
- 2026-04-23
- Attribution
- Trigona Ransomware Affiliates
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, healthcare, financial, legal, technology, construction, logistics
- Target regions
- North America, Western Europe, Australia, Japan
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Trigona Ransomware Affiliates Deploy Custom Exfiltration
Malware and tooling: TriStealer, trigona, Cobalt Strike, Cobalt Strike 4.10 with custom malleable profile, Mimikatz
Broadcom/Symantec Threat Hunter Team has observed Trigona ransomware affiliates deploying a custom-built exfiltration utility, tracked as 'TriStealer', during the pre-encryption staging phase of double-extortion intrusions. The bespoke tool replaces commodity utilities such as Rclone and MEGAsync, improves evasion against EDR signatures, and encrypts outbound archives over HTTPS to affiliate-controlled staging servers. The shift signals tooling maturity within the Trigona affiliate program and raises the bar for defenders relying on commodity-tool detection.
How Trigona Ransomware Affiliates Deploy Custom Exfiltration works
On 2026-04-22 Broadcom/Symantec's Threat Hunter Team published an analysis of recent Trigona ransomware intrusions showing a clear tactical shift: Trigona affiliates have begun deploying a custom-developed data exfiltration tool — internally referred to as 'TriStealer' by researchers — in the pre-ransomware staging phase instead of the commodity utilities (Rclone, MEGAsync, FileZilla) historically favoured by the group. Symantec's telemetry across multiple intrusions in North America and Western Europe between February and April 2026 confirms consistent use of the new tooling by at least two Trigona affiliates.
TriStealer is a 64-bit Windows PE written in Go, packed with a custom compiler-time obfuscator that randomises string tables and control-flow on each build. Observed samples are typically 4.8-6.2 MB, statically linked, and signed with short-lived Sectigo and Certum code-signing certificates issued to shell companies — a signing abuse pattern consistent with other ransomware affiliate programs (LockBit, BlackCat). The tool is staged by the operator after initial access and privilege escalation, most commonly dropped into C:\Users\Public\Libraries\wsuscli.exe, C:\ProgramData\Microsoft\NetFramework fx_sync.exe, or %APPDATA%\Local\Temp\onedrive_agent.exe to blend with legitimate file names.
On execution, TriStealer enumerates mapped drives, SMB shares, and specific high-value folder patterns (Finance, HR, Legal, Engineering, Backup, customers, contracts) using WinAPI FindFirstFileW/FindNextFileW. File collection is tuned: Office documents (.docx, .xlsx, .pptx), PDFs, CAD drawings (.dwg, .step), source code archives, and database dumps (.bak, .mdf, .sql, .dmp) are prioritised while anything under 2 KB or above 5 GB is skipped by default. Collected files are written to AES-256-GCM encrypted per-archive .tsa files (TriStealer Archive) in C:\ProgramData\Microsoft\DRM\ with a per-campaign hard-coded key derived at compile time.
Once archives reach a configurable size threshold (default 256 MB), TriStealer beacons to one of three embedded HTTPS endpoints using a rotating User-Agent and domain-fronted through Cloudflare and Fastly to make C2 blocking harder. Exfiltration uses HTTP/2 PUT requests with the archive chunked at 16 MB, and each request carries a custom 'X-TS-Id' header whose value is an HMAC-SHA256 of (campaign_id || chunk_id). After successful exfiltration the tool wipes local archives and inserts an alternate data stream (ADS) marker on the host to signal the ransomware deployment stage to the affiliate's encryption loader.
This TTP shift matters because (1) Rclone/MEGAsync signatures and configuration-file artefacts — which many EDRs and SIEM rules rely on for pre-encryption exfil detection — are entirely absent; (2) the custom archive format defeats DLP rules that key on known cloud-storage protocols; and (3) the dual-certificate signing complicates reputation-based blocking. Enterprises that previously relied on Rclone/MEGAsync detections as their primary pre-ransomware tripwire should expect a detection gap against Trigona intrusions until behavioural and network-pattern detections are deployed.
Symantec links TriStealer usage to Trigona affiliates with medium-to-high confidence based on (a) post-intrusion deployment of the Trigona ransomware encryptor on the same hosts within 6-36 hours of TriStealer execution, (b) reuse of TTPs established in prior Trigona playbooks (SplashTop/AnyDesk for persistence, Mimikatz + LSASS dumping for credential access, Cobalt Strike for lateral movement), and (c) overlap in the C2 infrastructure previously seen in 2025 Trigona incidents.
MITRE ATT&CK techniques used in TL-2026-0414
Credential Access
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive; T1560 Archive Collected Data
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Persistence
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Discovery
T1083 File and Directory Discovery; T1135 Network Share Discovery
command-and-control
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
Affected products and versions in Trigona Ransomware Affiliates Deploy Custom Exfiltration
- Microsoft — Windows (endpoints and servers)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Multiple — Enterprise environments with flat SMB networks and exposed RDP/VPN
Vulnerable versions: N/A
Remediation for Trigona Ransomware Affiliates Deploy Custom Exfiltration
Immediate actions
- Block listed TriStealer C2 domains and IPs at perimeter and DNS sinkhole
- Hunt for unsigned or short-lived-cert-signed Go binaries named wsuscli.exe, nfx_sync.exe, onedrive_agent.exe outside expected paths
- Alert on creation of *.tsa files in C:\ProgramData\Microsoft\DRM\
- Block outbound HTTP/2 traffic containing the X-TS-Id header at TLS-decrypting proxies
- Revoke and rotate any credentials harvested from LSASS dumps in affected hosts
Workarounds
- Disable outbound HTTPS to uncategorised Cloudflare Workers subdomains from critical servers
- Reduce attack surface of RDP and VPN appliances known as Trigona initial-access vectors
- Enable Windows Defender ASR rule 'Block credential stealing from the Windows local security authority subsystem'
Longer-term hardening
- Deploy behavioural EDR rules detecting large-volume file enumeration followed by outbound TLS to freshly registered domains
- Implement egress DLP that detects anomalous per-host outbound volume regardless of protocol
- Enforce application allow-listing (WDAC/AppLocker) to block unsigned binaries in Public/ProgramData/Temp paths
- Segment backup infrastructure off the primary domain and require air-gapped or immutable storage
- Adopt Sigma-based generic pre-ransomware exfil detections that key on behaviour rather than tool signature
Weaknesses (CWE) in Trigona Ransomware Affiliates Deploy Custom Exfiltration
CWE-732, CWE-284, CWE-200
Timeline of Trigona Ransomware Affiliates Deploy Custom Exfiltration
- Trigona ransomware first observed in the wild; early samples link back to CryLock operators (historical context).
- CISA publishes #StopRansomware: Trigona advisory summarising Rclone/MEGAsync exfiltration TTPs.
- Sophos X-Ops documents professionalisation of Trigona affiliate tradecraft including SplashTop/AnyDesk persistence.
- Symantec first observes unknown Go binary performing large-scale file enumeration and HTTPS exfiltration on a North American manufacturer; retrospectively attributed to TriStealer.
- Second TriStealer deployment observed at a European legal firm; identical code-signing shell-company certificate used.
- Trigona encryptor deployed 28 hours after TriStealer execution at a third victim, confirming tool's role in the pre-ransomware playbook.
- Third C2 cluster stood up behind Cloudflare and Fastly domain fronting; short-lived Sectigo certificate rotation observed.
- Broadcom/Symantec Threat Hunter Team publishes public report detailing TriStealer custom exfiltration tool.
- Threadlinqs Intelligence begins tracking campaign as TL-2026-0414 with full MITRE ATT&CK mapping and detection coverage.
- As of 2026-05-29, this remains an active threat: Symantec/Broadcom disclosed it April 23, 2026 from March 2026 intrusions, and Trigona affiliates (Symantec "Rhantus") have resumed operations with a new leak site despite the Oct-2023 takedown. The custom exfil tool (uploader_client.exe) is a behavioral TTP with no CVE/patch, so the detection gap and campaign stay live; no takedown or arrests since disclosure.
Sources cited for Trigona Ransomware Affiliates Deploy Custom Exfiltration
- Symantec Threat Hunter: Trigona Affiliates Custom Exfiltration Tooling
- MITRE ATT&CK Software: Trigona Ransomware (S1157)
- CISA #StopRansomware: Trigona Ransomware
- Unit 42: Trigona Ransomware Threat Assessment
- Trend Micro: Trigona Ransomware Analysis
- Sophos X-Ops: Trigona Affiliate Tradecraft
- MITRE ATT&CK Technique: Archive Collected Data (T1560.001)
- MITRE ATT&CK Technique: Exfiltration Over Web Service (T1567)
- Broadcom Symantec Protection Bulletin: TriStealer
Threats related to Trigona Ransomware Affiliates Deploy Custom Exfiltration
Detection coverage for TL-2026-0414
As of 2026-04-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0414 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.