Trigona
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 5 incidents
- Sources
- 4 sources
- First seen
- 2023-03-10
- Last seen
- 2023-08-15
- Updated
- 2026-10-18 05:21
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Trigona, also known as the Trigona ransomware group, is a Russia‑based cybercriminal actor. It targets a range of sectors including technology parks, engineering firms, educational institutions, healthcare providers, and municipal governments across regions such as Hong Kong, Italy, and the United States. Its primary objective is financial gain, achieved through ransom demands (often in cryptocurrency) and the sale of exfiltrated data, sometimes employing a double‑extortion model that combines file encryption with threats to leak or auction stolen information. Observed tactics include exploiting vulnerable SQL Server services via brute‑force to deploy the CLR Shell malware, using ransomware that encrypts files with ChaCha20 and ECC algorithms, and maintaining persistence through remote‑access tools such as RDP, Anydesk, VNC, proxy, and TeamViewer. The group has described itself as a closed entity with no public affiliations to larger criminal consortia or state sponsors. Representative operations include the 2023 intrusion into Unique Imaging’s network where Trigona claimed six‑month access to a radiology information system and exfiltrated protected health information; the attack on the City of Franklin, Tennessee in which approximately 428 GB of data were taken, a 10 BTC ransom was demanded, and the group later provided network‑hardening advice; and the Lolaico Impianti incident where stolen corporate data was offered for sale for $100,000 rather than a decryption key.
Incidents
Attributed incidents are available to members.
5 incidentsSources
Sources available to members: 4 sources.