Description Summary
According to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, it drops the how_to_decrypt.hta file that opens a ransom note. An example of how Trigona renames files: it renames 1.jpg to 1.jpg._locked, 2.png to 2.png._locked, and so forth. It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.
Threat Actor
Assessed overlap with ALPHV/BlackCat and CryLock; access via brute-forced MS-SQL and exposed RDP.
Technical Indicators
Encryption Extension
._locked
Encryption Algorithm
AES-256 + RSA-4096
Ransom Note Name
how_to_decrypt.hta
Targeted Industries
Manufacturing, Finance, Technology, Agriculture
First Seen
October 2022
Last Seen
2023 (leak site wiped by the Ukrainian Cyber Alliance)
Geographical Location
Worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |