Tactical Evolution: Trigona Ransomware Debuts Custom Exfiltration Armory

The report describes Trigona (Rhantus) affiliates shifting from off-the-shelf exfiltration tools to a proprietary high-performance uploader (uploader_client.exe) observed in March 2026; the utility uses parallel streaming, connection rotation, extension-based filtering, and shared-key authentication to stealthily exfiltrate high-value files. Operators are observed disabling security at the kernel level (installing HRSword and leveraging tools like PCHunter/Gmer/YDark), then using AnyDesk and Mimikatz to gain remote access and harvest credentials for lateral movement.