Full Report
Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster and more efficiently. [...]
Analysis Summary
# Tool/Technique: uploader_client.exe (Trigona Custom Exfiltrator)
## Overview
This is a custom, command-line exfiltration tool developed specifically for the **Trigona ransomware** operation. Its primary purpose is to automate the theft of sensitive data from compromised environments while remaining undetected by security solutions that typically flag common tools like Rclone or MegaSync.
## Technical Details
- **Type:** Data Exfiltration Tool
- **Platform:** Windows
- **Capabilities:** Parallel data uploading, traffic rotation, selective file filtering, and authenticated C2 communication.
- **First Seen:** March 2024 (Reported April 2024)
## MITRE ATT&CK Mapping
- **[TA0009 - Collection]**
- [T1005 - Data from Local System]
- [T1039 - Data from Network Shared Drive]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- [T1030 - Data Transfer Size Limits] (Connection rotation)
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (Via associated drivers/tools)
- [T1027 - Obfuscated Files or Information]
## Functionality
### Core Capabilities
- **Parallel Uploads:** Supports five simultaneous connections per file to maximize exfiltration speed.
- **Selective Filtering:** Configurable to target specific high-value file types (e.g., PDFs, invoices) while ignoring large media files to reduce noise.
- **Hardcoded C2:** Communicates with a predefined server address for streamlined deployment.
### Advanced Features
- **TCP Connection Rotation:** Automatically rotates TCP connections after every 2GB of data transferred to bypass network volume monitoring and rate-limiting triggers.
- **Authenticated Access:** Uses an internal authentication key to ensure only the threat actor can access the exfiltrated data on the receiving server.
- **Evasion-Centric Design:** Built as a proprietary tool to avoid the "Known Bad" signatures associated with public cloud-sync utilities.
## Indicators of Compromise
- **File Names:** `uploader_client.exe`
- **Behavioral Indicators:**
- Multiple concurrent outbound TCP connections to a single remote IP.
- High volume of read operations on network shares followed by spikes in outbound encrypted traffic.
- Presence of associated tools: `HRSword`, `PCHunter`, `Gmer`, `YDark`, `WKTools`, `DumpGuard`, `StpProcessMonitorByovd`.
## Associated Threat Actors
- **Trigona Ransomware Group** (and its affiliates).
## Detection Methods
- **Behavioral detection:** Monitor for processes initiating multiple outbound connections that rotate systematically after 2GB of data transfer.
- **Process Monitoring:** Detect the execution of unsigned or uncommon command-line utilities that perform recursive file reads across network drives.
- **Kernel Watch:** Monitor for the loading of vulnerable or suspicious drivers (BYOVD - Bring Your Own Vulnerable Driver) used by HRSword or YDark to terminate EDR/AV processes.
## Mitigation Strategies
- **Network Segmentation:** Restrict the ability of workstations to communicate with unknown external IP addresses over non-standard ports.
- **Principle of Least Privilege:** Limit user access to network shares to prevent bulk data discovery and collection.
- **EDR Hardening:** Enable features that prevent the unloading of security agents or the loading of known vulnerable drivers.
- **File Integrity Monitoring:** Implement alerts for large-scale data copying or reading from sensitive file repositories.
## Related Tools/Techniques
- **Rclone / MegaSync:** Public tools this custom client was designed to replace for evasion.
- **PowerRun:** Used by the group to launch the tool with elevated privileges.
- **HRSword / YDark:** Kernel-level tools used in tandem to disable defenses before running the exfiltrator.
- **AnyDesk:** Used for initial remote access and manual environment staging.