Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Symantec and Carbon Black observed the Trigona ransomware-as-a-service (RaaS) operation—attributed to an actor called Rhantus—using a custom-built data-theft tool in March 2026, indicating a shift away from common exfiltration utilities to proprietary tooling; Trigona has reappeared after a period of apparent dormancy, though known URLs are currently down.