Trinity Ransomware Targets the Healthcare Sector

HHS warns that the Trinity ransomware group (first observed May 2024) is conducting double-extortion attacks against healthcare organizations, gaining access via phishing and software vulnerabilities, performing privilege escalation and lateral movement, exfiltrating sensitive data before encrypting systems, and has claimed seven victims (including two healthcare providers and a U.S. gastroenterology provider with 330 GB of data).