Skip to main content
Darkfield

Operator dossier

Trigona is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 49 public victims claimed by this operator between April 17, 2023 and March 30, 2024. Trigona is a relatively new ransomware group that emerged in April 2023, operating with primarily financial motivations and targeting organizations across multiple sectors globally. The group's origin and specific affiliations remain unclear based on publicly available intelligence, though their targeting patterns suggest they operate as an independent entity rather than a established Ransomware-as-a-Service operation. Trigona employs double extortion tactics, combining data encryption with data exfiltration and threats to publish stolen information on leak sites, though specific details about their initial access vectors and encryption methods have not been extensively documented by major security researchers. The group has claimed 49 victims as of current reporting, with their attacks concentrated in the United States, Australia, Mexico, France, and Indonesia, primarily targeting business services, manufacturing, healthcare, technology, and finance sectors. Given the group's recent emergence in 2023, there are no widely reported major campaigns or significant law enforcement actions documented by CISA, FBI, or established threat intelligence firms. Trigona appears to remain active as of current intelligence assessments, though the limited public documentation reflects their relatively recent entry into the ransomware landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by Trigona

All 49 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Trigona →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Trigona

49 victims indexed · first seen 3 years ago · last activity 2 years ago

49
Victims indexed
#106 of 364 tracked operators
11m
Active period
Apr 2023 → Mar 2024
10
Countries hit
top United States · 9

At a glance

Status
inactive
First seen
3 years ago
Last activity
2 years ago
Onion sites
9 known endpoints
Primary sector
Business Services · 7 hits

About

Trigona is a relatively new ransomware group that emerged in April 2023, operating with primarily financial motivations and targeting organizations across multiple sectors globally. The group's origin and specific affiliations remain unclear based on publicly available intelligence, though their targeting patterns suggest they operate as an independent entity rather than a established Ransomware-as-a-Service operation. Trigona employs double extortion tactics, combining data encryption with data exfiltration and threats to publish stolen information on leak sites, though specific details about their initial access vectors and encryption methods have not been extensively documented by major security researchers. The group has claimed 49 victims as of current reporting, with their attacks concentrated in the United States, Australia, Mexico, France, and Indonesia, primarily targeting business services, manufacturing, healthcare, technology, and finance sectors. Given the group's recent emergence in 2023, there are no widely reported major campaigns or significant law enforcement actions documented by CISA, FBI, or established threat intelligence firms. Trigona appears to remain active as of current intelligence assessments, though the limited public documentation reflects their relatively recent entry into the ransomware landscape.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

8 months
2023-04-01T00:00:00+00:00 · 72023-05-01T00:00:00+00:00 · 112023-06-01T00:00:00+00:00 · 12023-09-01T00:00:00+00:00 · 42023-10-01T00:00:00+00:00 · 72024-01-01T00:00:00+00:00 · 92024-02-01T00:00:00+00:00 · 42024-03-01T00:00:00+00:00 · 6
2023-04-01T00:00:00+00:002024-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
9
🇦🇺 Australia
3
🇲🇽 Mexico
3
🇫🇷 France
2
🇮🇩 Indonesia
2
🇮🇹 Italy
2
🇬🇧 United Kingdom
2
🇪🇸 Spain
2
United States dossier →Australia dossier →Mexico dossier →France dossier →

Top sectors

Business Services
7
Manufacturing
4
Healthcare
4
Technology
3
Finance
1
Financial
1
Education
1
Hospitality and Tourism
1
Business Services dossier →Manufacturing dossier →Healthcare dossier →Technology dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

Recent victims

Loading…

Onion infrastructure

9 known
  • http://3x55o3u2b7cjs54eifja5m3ottxntlubhjzt6k6htp5nrocjmsxxh7ad.onion
  • http://6n5tfadusp4sarzuxntz34q4ohspiaya2mc6aw6uhlusfqfsdomavyyd.onion
  • http://6n5tfadusp4sarzuxntz34q4ohspiaya2mc6aw6uhlusfqfsdomavyyd.onion/
  • http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion
  • http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion/api?page=1
  • http://trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion
  • http://trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion/api
  • http://znuzuy4hkjacew5y2q7mo63hufhzzjtsr2bkjetxqjibk4ctfl7jghyd.onion
  • http://znuzuy4hkjacew5y2q7mo63hufhzzjtsr2bkjetxqjibk4ctfl7jghyd.onion/signin

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Trigona posts a victim.

Add Trigona to your watchlist — Pro pings you within 5 minutes of any new Trigona leak-site post, Telegram callout, or affiliate-rebrand inference.