Trigona Ransomware Uses Custom Tool to Speed Data Theft and Dodge Detection

Why It Matters

The emergence of a custom exfiltration tool underscores a maturation of ransomware operations from opportunistic crime to a more sophisticated, software‑development‑driven model. By sidestepping widely‑known utilities, attackers can stay under the radar longer, increasing the window for data theft and ransom negotiation. This development pressures defenders to move beyond signature‑based defenses and invest in real‑time traffic analysis, threat‑hunting, and zero‑trust architectures. Furthermore, Trigona’s affiliation with the Rhantus cybercrime group means the technique could proliferate across other Ransomware‑as‑a‑Service offerings. If the custom tool proves effective, it may set a new baseline for exfiltration speed and stealth, raising the stakes for enterprises worldwide and potentially driving up the cost of breach remediation and insurance premiums.

Key Takeaways

• Trigona ransomware used a custom uploader_client.exe tool in March 2026 attacks
• The tool opens five parallel connections per file and rotates after 2,048 MB to avoid detection
• It replaces public exfiltration utilities like Rclone and MegaSync
• Attackers disable security tools with HRSword, PCHunter, GMER and use AnyDesk for remote access
• Custom tooling signals a shift toward proprietary ransomware development, challenging signature‑based defenses

Pulse Analysis

The adoption of uploader_client.exe reflects a broader trend where ransomware operators treat malware development as a product line rather than a one‑off script. Historically, ransomware relied on readily available open‑source tools to move data, which gave defenders a predictable set of indicators. By investing in in‑house exfiltration code, groups like Trigona can tailor network behavior to slip past existing detection rules, effectively resetting the cat‑and‑mouse game.

From a market perspective, this evolution may accelerate the arms race between security vendors and cybercriminals. Vendors will likely push for more advanced behavioral analytics, leveraging machine‑learning models that flag anomalous parallel connections or sudden TCP resets, while attackers will iterate on obfuscation techniques to hide those very patterns. The cost of developing such custom tools is non‑trivial, suggesting that only well‑funded RaaS operators will sustain this approach, potentially consolidating power among a few elite groups.

For enterprises, the key takeaway is the need to adopt a defense‑in‑depth posture that does not rely solely on known bad binaries. Continuous monitoring of network flows, strict application whitelisting, and rapid patching of kernel‑driver vulnerabilities become essential. As ransomware continues to professionalize its toolchain, the window for effective response narrows, making proactive threat hunting and rapid incident response capabilities a competitive advantage for any organization.