Trigona — Ransomware Profile

Trigona ransomware targets MSSQL servers for initial access, attacking organizations across multiple sectors globally.

Also tracked as

Salty Scorpius, Water Ungaw

Advanced Port Scanner network-discovery
AnyDesk Remote access tool (abused for lateral movement)
CLR shell Privilege escalation (Common Language Runtime shell used on compromised MSSQL servers)
Cobalt Strike post-exploitation
defoff.bat Defense evasion script (terminates antivirus services)
LogMeIn Remote access tool (abused for lateral movement)
MEGA exfiltration
MHYPROTINST Defense evasion driver abuse (antivirus process termination)
Mimikatz credential-access
Rclone exfiltration
ScreenConnect Remote access tool (abused for lateral movement)
SoftPerfect NetScan network-discovery
Splashtop remote-access
TeamViewer Remote access tool (abused for lateral movement)
Trigona (ransomware encryptor) ransomware
turnoff.bat Defense evasion script (terminates antivirus services)