Trigona ransomware attacks use custom exfiltration tool to steal data

Symantec reports that recent Trigona ransomware campaigns have incorporated a custom exfiltration utility (uploader_client.exe) to speed and stealth data theft from compromised environments as part of double‑extortion operations; the actors used kernel driver services, tools to disable endpoint protections, credential theft utilities (e.g., Mimikatz), remote access (AnyDesk), and published IoCs to aid detection.