Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Bee-Ware of Trigona, An Emerging Ransomware Strain

Summary: Unit 42 researchers first identified Trigona ransomware in late October 2022 and found it compromised at least 15 potential victims in December 2022, across manufacturing, finance, construction, agriculture, marketing and high technology in the US, Italy, France, Germany, Australia and New Zealand. The binary, named svhost.exe, encrypts files with a Delphi AES library, appends the ._locked extension, establishes persistence through two CurrentVersion\Run keys, and drops an HTML Application ransom note named how_to_decrypt.hta containing embedded JavaScript with unique computer and victim IDs.

What you should know: Trigona's operators used a compromised Windows 2003 server, NetScan with Cyrillic output, Splashtop to move malware, and password-protected binaries (password 'boris') to evade static detection - and Unit 42 notes the strain's low news coverage lets it attack while higher-profile operations dominate headlines.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026