Ransomware Hackers Develop Custom Exfiltration Tool to Steal Sensitive Data

Symantec researchers observed Trigona ransomware affiliates using a custom command-line exfiltration tool (uploader_client.exe) to selectively steal high-value financial and PDF documents; attackers paired this with kernel-level defense evasion (HRSword, PCHunter, Gmer), credential theft (Mimikatz, Nirsoft tools), and AnyDesk remote access. The uploader optimizes speed and stealth via parallel connections, connection rotation, and exclusion flags, while the campaign's RaaS model and proprietary tooling raise detection difficulty and risk to organizations handling sensitive financial records.