trigona
First seen April 17, 2023Active49 claimed victims
The claims below are reproduced as posted by trigona on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
According to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, it drops the how_to_decrypt.hta file that opens a ransom note. An example of how Trigona renames files: it renames 1.jpg to 1.jpg._locked, 2.png to 2.png._locked, and so forth.It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Claro | March 30, 2024 | ransomware_live | — |
| South Star Electronics | March 20, 2024 | ransomware_live | — |
| Topa Partners | March 16, 2024 | ransomware_live | — |
| Bwizer | March 16, 2024 | ransomware_live | — |
| Indoarsip | March 16, 2024 | ransomware_live | — |
| Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, Pension Alemana | February 28, 2024 | ransomware_live | — |
| Dinamic Oil | February 28, 2024 | ransomware_live | — |
| ATMCo | February 21, 2024 | ransomware_live | — |
| Daher Contracting | January 30, 2024 | ransomware_live | — |
| CMG Drainage Engineering | January 30, 2024 | ransomware_live | — |
| FALCO Electronics | January 30, 2024 | ransomware_live | — |
| Genesis Motors | January 29, 2024 | ransomware_live | — |
| Lomma Crane & Rigging | January 25, 2024 | ransomware_live | — |
| America Movil | January 25, 2024 | ransomware_live | — |
| Vision Plast | January 18, 2024 | ransomware_live | — |
| Fertility North | January 18, 2024 | ransomware_live | — |
| Premier Facility Management | January 18, 2024 | ransomware_live | — |
| Samuel Sekuritas Indonesia & Samuel Aset Manajemen | January 18, 2024 | ransomware_live | — |
| Ausa | January 11, 2024 | ransomware_live | — |
| Alconex Specialty Products | October 13, 2023 | ransomware_live | — |
| FPZ | October 12, 2023 | ransomware_live | — |
| Quest International | October 1, 2023 | ransomware_live | — |
| Grupo Boreal | October 1, 2023 | ransomware_live | — |
| Portesa | October 1, 2023 | ransomware_live | — |
| Aria Care Partners | October 1, 2023 | ransomware_live | — |
| Flamingo Holland | October 1, 2023 | ransomware_live | — |
| Steelforce | September 15, 2023 | ransomware_live | — |
| Cedar Holdings | September 13, 2023 | ransomware_live | — |
| Cyberport | September 5, 2023 | ransomware_live | — |
| Unimed | September 5, 2023 | ransomware_live | — |
| Public Health Management Corporation | June 6, 2023 | ransomware_live | — |
| Pacific Union College | May 30, 2023 | ransomware_live | — |
| Marshall Construction Ltd | May 26, 2023 | ransomware_live | — |
| Leidos | May 25, 2023 | ransomware_live | — |
| Technology and Telecommunications Consultants Inc | May 22, 2023 | ransomware_live | — |
| Rolser | May 19, 2023 | ransomware_live | — |
| Lolaico Impianti | May 18, 2023 | ransomware_live | — |
| Feit Electric | May 16, 2023 | ransomware_live | — |
| Accudo Investments LTD | May 15, 2023 | ransomware_live | — |
| TTCCPA | May 13, 2023 | ransomware_live | — |
| Axiom Professional Solutions | May 11, 2023 | ransomware_live | — |
| Fresh Insurance IT Services | May 9, 2023 | ransomware_live | — |
| Treadwell, Tamplin & Company, Certified Public Accountants, Madison, GA | April 18, 2023 | ransomware_live | — |
| Unique Imaging | April 17, 2023 | ransomware_live | — |
| Office Notarial de Baillargues | April 17, 2023 | ransomware_live | — |
| Amouage | April 17, 2023 | ransomware_live | — |
| McKinney Trailers | April 17, 2023 | ransomware_live | — |
| Winter Park Construction | April 17, 2023 | ransomware_live | — |
| Albany Clinic | April 11, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).