Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Reported 01 May 2026 by otx · Severity: medium

Trigona ransomware affiliates deployed a custom exfiltration tool called uploader_client.exe during attacks in March 2026, marking a tactical shift from relying on off-the-shelf utilities like Rclone. The tool features parallel streams with five default connections, connection ro