Hackers Deploy New Exfiltration Tool In Ransomware Attacks

Symantec-tracked Trigona (Rhantus) ransomware affiliates have moved from public sync tools to a custom high-speed exfiltration uploader that selectively steals high-value documents; they complement this with kernel-level security disabling (HRSword and vulnerable drivers), remote access (AnyDesk/PowerRun), and a suite of tools to evade detection, with multiple SHA-256 IOCs provided and guidance to monitor for unauthorized remote tools and kernel driver installations.