Trigona is a Delphi-based ransomware that encrypts files using RSA and AES with a novel residual block termination, adds a multi-step decryption workflow, and recently gained a data wiper capability. ThreatLabz notes overlap in tactics with BlackCat/ALPHV, but emphasizes Trigona’s distinct Delphi codebase and publicly hosted data-leak portal. #Trigona #ThreatLabz
Keypoints
- Trigona is a ransomware family written in the Delphi programming language that has been active since at least June 2022
- The Trigona threat group claims to perform double extortion attacks by combining data exfiltration with file encryption
- Trigona utilizes 4,112-bit RSA and 256-bit AES encryption in OFB mode for file encryption
- The file decryption process is fairly convoluted with a tool that requires several steps to function properly
- The ransomware has been regularly updated with new capabilities including a new data wiper feature
- ThreatLabz notes overlap with BlackCat/ALPHV but stresses the Trigona codebase is distinct and its ransom portal is publicly hosted
MITRE Techniques
- [T1059] Command-Line Interface – Trigona can be executed with or without command-line arguments. The latest versions of Trigona support the following parameters shown in Table 1. “Trigona can be executed with or without command-line arguments. The latest versions of Trigona support the following parameters shown in Table 1.”
- [T1060] Registry Run Keys/Startup Folder – The autorun registry value will be created in HKEY_CURRENT_USERSSoftwareMicrosoftWindowsCurrentVersionRun with a registry name that consists of an uppercase hex string derived from the MD5 hash of the CID reversed, with the registry value pointing to the Trigona ransomware executable path. “The autorun registry value will be created in … with a registry name that consists of an uppercase hex string derived from the MD5 hash of the CID reversed, with the registry value pointing to the Trigona ransomware executable path.”
- [T1218.005] Signed Binary Proxy Execution: HTA – Trigona creates an HTML Application (how_to_decrypt.hta) that contains the ransom note. “Trigona creates an HTML Application (HTA) file named how_to_decrypt.hta that contains the ransom note.”
- [T1486] Data Encrypted for Impact – Trigona utilizes 4,112-bit RSA and 256-bit AES encryption in OFB mode for file encryption. “Trigona utilizes 4,112-bit RSA and 256-bit AES encryption in OFB mode for file encryption.”
- [T1485] Data Destruction – The data wiper functionality overwrites files with NULL bytes and can erase full content when /erase is used. “overwrite files with NULL bytes, rename with a ._erased extension, and delete; by default the first 0x80000 bytes (512KB) will be overwritten” and “The wiper functionality is triggered by passing the /erase command-line parameter.”
- [T1041] Exfiltration – Trigona exfiltrates data prior to encryption and hosts a data leak site publicly. “exfiltrate data prior to performing file encryption and hosts a data leak site that is hosted on a publicly available website”
Indicators of Compromise
- [SHA256] Trigona ransomware with data wiper functionality – 8cbe32f31befe7c4169f25614afd1778006e4bda6c6091531bc7b4ff4bf62376, efb688214c3fe5d9273ec03641cf17af5f546b11c97a965a49f8e617278ac700, and other 11 hashes
Read more: https://www.zscaler.com/blogs/security-research/technical-analysis-trigona-ransomware