Trigona ransomware adopts custom tool to steal data and evade detection

Trigona ransomware affiliates have begun using a proprietary command-line exfiltration tool (uploader_client.exe) that performs parallel, rotating TCP connections and file filtering to accelerate and stealthily steal sensitive documents from network drives; attackers also disable security products (via HRSword, PCHunter, GMER and vulnerable kernel drivers), remotely access systems with AnyDesk, and harvest credentials with Mimikatz and Nirsoft utilities, indicating a more sophisticated and stealth-focused evolution of the group's tactics.