Trigona Ransomware Hits 4 Countries At Once

Trigona ransomware infiltrated 4 targets recently in France, US, Austria, and Indonesia. The attacks were successful, in the sense that the hacker breached the victims’ defense systems and stole and encrypted valuable data.

• The 4 victims are Vision Plast, Fertility North, Premier Facility Management, and PT Samuels Sekuritas Indonesia
• There is no clear data regarding the aftermath of the attacks or the value of the ransoms
• Trigona doesn’t rank among the most aggressive or well-known ransomware actors, but it is among the most stable in the market
• The ransomware actor first became public in October of 2022, but traces of its binaries were observed starting with June 2022

The cyberhacking actor often targets multiple enterprises at a time to increase the chance of successful payments. The attacks always disrupt the victims’ normal operations and often lead their websites to go offline.

The recovery window varies depending on the severity of the attack. Some victims manage to overcome the fallout within hours, others require weeks, and others must pay the ransom.

Despite its relatively low profile, Trigona appears to be a very lucrative organization, with significant gains, especially during the first months of operations. According to anonymous sources, Trigona would get up to 50% ransom payment rate.

This is considerably higher than many other ransomware actors, some of which can’t get past 20%. Such a difference is attributed to Trigona’s MO and propensity for collaborating with affiliates and other cyber-hacking organizations.