Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft

Reported 23 Apr 2026 by otx · Severity: medium

Trigona ransomware affiliates have adopted a custom-developed exfiltration tool called uploader_client.exe in attacks observed during March 2026, marking a significant tactical evolution. This command-line utility features parallel data streams, connection rotation to evade netwo