{
	"id": "d3ba9f8a-f034-4f96-8f99-278541ea75f4",
	"created_at": "2026-04-06T00:12:16.528561Z",
	"updated_at": "2026-04-10T03:19:59.739232Z",
	"deleted_at": null,
	"sha1_hash": "e6712763da2eb8ae40c0f5e11a27fe542d6fb124",
	"title": "Ransomware Roundup – Trigona | FortiGuard Labs",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 59881,
	"plain_text": "Ransomware Roundup – Trigona | FortiGuard Labs\r\nBy Shunichi Imano\r\nPublished: 2023-02-02 · Archived: 2026-04-05 15:57:47 UTC\r\nOn a bi-weekly basis, FortiGuard Labs gathers data on ransomware variants of interest that have been gaining\r\ntraction within our datasets and the OSINT community. The Ransomware Roundup report aims to provide readers\r\nwith brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those\r\nvariants.\r\nThis latest edition of the Ransomware Roundup covers the Trigona ransomware.\r\nAffected platforms: Microsoft Windows\r\nImpacted parties: Microsoft Windows Users\r\nImpact: Encrypts files on the compromised machine and demands ransom for file decryption\r\nSeverity level: High\r\nTrigona Ransomware Overview\r\nThe Trigona ransomware variant was first reported in October 2022. Trigona has adopted the double-extortion\r\nmethodology of encrypting endpoints and/or other infrastructure of value within an organization and then\r\nthreatening to release exfiltrated data from those machines on the internet if a ransom is not paid. As proof that\r\nusers can get affected files back, the Trigona threat actor offers free decryption of up to three files.\r\nSome public reports suggest Trigona ransomware activity picked up towards the end of 2022.\r\nTrigona Ransomware Infection Vector\r\nWhile the infection vector has not been identified, deployment via other malware distributed using emails, Remote\r\nDesktop Protocol (RDP), and exploiting vulnerabilities are suspected distribution methods.\r\nTrigona Ransomware Execution\r\nWhen launched, the ransomware encrypts files on compromised machines and adds a “._locked” file extension to\r\nthose encrypted files.\r\nIt also leaves a “how_to_decrypt.hta” file, shown below. This is an HTML file that contains details on how to\r\nrecover encrypted data as well as how to contact the Trigona ransomware threat actor. While a download link for\r\nthe Tor browser is available in the ransom note, it no longer worked at the time of the investigation. As such, users\r\nare expected to find and visit the official Tor site to download and install the Tor browser.\r\nOnce a link to the decryption page is copied and opened on the Tor browser, Trigona ransomware victims are\r\npresented with a sign-up page where they can enter a key left in the ransom note.\r\nhttps://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware\r\nPage 1 of 4\n\nIn the next screen, victims are asked to enter a username and set a login password.\r\nSome variants of Trigona ransomware do not direct victims to the Tor site. Instead, the ransom note asks victims\r\nto email the attacker.\r\nPublicly available reports indicate that victims are asked to buy and pay an unknown amount of ransom in Monero\r\n(XMR) cryptocurrency after logging into the Tor site. The Tor site also offers a victim support chat option.\r\nFortinet Protection\r\nFortinet customers are already protected from this malware variant through FortiGuard’s Web Filtering, AntiVirus,\r\nand FortiEDR services, as follows:\r\nFortiGuard Labs detects known Trigona ransomware variants with the following AV signature:\r\nW32/Filecoder.OLC!tr.ransom\r\nIOCs\r\nFile-based IOCs:\r\nSHA256\r\n248e7d2463bbfee6e3141b7e55fa87d73eba50a7daa25bed40a03ee82e93d7db\r\n596cf4cc2bbe87d5f19cca11561a93785b6f0e8fa51989bf7db7619582f25864\r\n704f1655ce9127d7aab6d82660b48a127b5f00cadd7282acb03c440f21dae5e2\r\n859e62c87826a759dbff2594927ead2b5fd23031b37b53233062f68549222311\r\n8f8d01131ef7a66fd220dc91388e3c21988d975d54b6e69befd06ad7de9f6079\r\n97c79199c2f3f2edf2fdc8c59c8770e1cb8726e7e441da2c4162470a710b35f5\r\na86ed15ca8d1da51ca14e55d12b4965fb352b80e75d064df9413954f4e1be0a7\r\nhttps://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware\r\nPage 2 of 4\n\naccd5bcf57e8f9ef803079396f525955d2cfffbf5fe8279f744ee17a7c7b9aac\r\nda32b322268455757a4ef22bdeb009c58eaca9717113f1597675c50e6a36960a\r\ne7c9ec3048d3ea5b16dce31ec01fd0f1a965f5ae1cbc1276d35e224831d307fc\r\ne97de28072dd10cde0e778604762aa26ebcb4cef505000d95b4fb95872ad741b\r\nf29b948905449f330d2e5070d767d0dac4837d0b566eee28282dc78749083684\r\nfa6f869798d289ee7b70d00a649145b01a93f425257c05394663ff48c7877b0d\r\nfbba6f4fd457dec3e85be2a628e31378dc8d395ae8a927b2dde40880701879f2\r\nfd25d5aca273485dec73260bdee67e5ff876eaa687b157250dfa792892f6a1b6\r\nFortiGuard Labs Guidance\r\nDue to the ease of disruption, damage to daily operations, potential impact to an organization’s reputation, and the\r\nunwanted destruction or release of personally identifiable information (PII), etc., it is vital to keep all AV and IPS\r\nsignatures up to date.\r\nSince the majority of ransomware is delivered via phishing, organizations should consider leveraging Fortinet\r\nsolutions designed to train users to understand and detect phishing threats:\r\nThe FortiPhish Phishing Simulation Service uses real-world simulations to help organizations test user awareness\r\nand vigilance to phishing threats and to train and reinforce proper practices when users encounter targeted\r\nphishing attacks.\r\nOur FREE NSE training: NSE 1 – Information Security Awareness includes a module on internet threats designed\r\nto help end users learn how to identify and protect themselves from various types of phishing attacks and can be\r\neasily added to internal training programs.\r\nOrganizations will need to make foundational changes to the frequency, location, and security of their data\r\nbackups to effectively deal with the evolving and rapidly expanding risk of ransomware. When coupled with\r\ndigital supply chain compromise and a workforce telecommuting into the network, there is a real risk that attacks\r\nhttps://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware\r\nPage 3 of 4\n\ncan come from anywhere. Cloud-based security solutions, such as SASE, to protect off-network devices;\r\nadvanced endpoint security, such as EDR (endpoint detection and response) solutions that can disrupt malware\r\nmid-attack; and Zero Trust Access and network segmentation strategies that restrict access to applications and\r\nresources based on policy and context, should all be investigated to minimize risk and to reduce the impact of a\r\nsuccessful ransomware attack.\r\nAs part of the industry's leading fully integrated Security Fabric, delivering native synergy and automation across\r\nyour security ecosystem, Fortinet also provides an extensive portfolio of technology and human-based as-a-service offerings. These services are powered by our global FortiGuard team of seasoned cybersecurity experts.\r\nBest Practices include Not Paying a Ransom\r\nOrganizations such as CISA, NCSC, the FBI, and HHS caution ransomware victims against paying a ransom\r\npartly because payment does not guarantee that files will be recovered. According to a U.S. Department of\r\nTreasury's Office of Foreign Assets Control (OFAC) advisory, ransom payments may also embolden adversaries to\r\ntarget additional organizations, encourage other criminal actors to distribute ransomware, and/or fund illicit\r\nactivities that could potentially be illegal. For organizations and individuals affected by ransomware, the FBI has a\r\nRansomware Complaint page where victims can submit samples of ransomware activity via their Internet Crimes\r\nComplaint Center (IC3).\r\nHow Fortinet Can Help\r\nFortiGuard Labs’ Emergency Incident Response Service provides rapid and effective response when an incident is\r\ndetected. And our Incident Readiness Subscription Service provides tools and guidance to help you better prepare\r\nfor a cyber incident through readiness assessments, IR playbook development, and IR playbook testing (tabletop\r\nexercises).\r\nLearn more about Fortinet’s FortiGuard Labs threat research and intelligence organization and the FortiGuard\r\nAI-powered security services portfolio.\r\nSource: https://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware\r\nhttps://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware"
	],
	"report_names": [
		"ransomware-roundup-trigona-ransomware"
	],
	"threat_actors": [],
	"ts_created_at": 1775434336,
	"ts_updated_at": 1775791199,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e6712763da2eb8ae40c0f5e11a27fe542d6fb124.pdf",
		"text": "https://archive.orkl.eu/e6712763da2eb8ae40c0f5e11a27fe542d6fb124.txt",
		"img": "https://archive.orkl.eu/e6712763da2eb8ae40c0f5e11a27fe542d6fb124.jpg"
	}
}