Symantec Details Trigona Affiliates’ Custom Data Exfiltration Tool
Summary
Symantec reports that Trigona affiliates used a custom uploader in March 2026, with parallel transfers, connection rotation and file filtering, after disabling defenses; intrusions also involved AnyDesk and credential-theft tools.
Key points
- Symantec observed Trigona affiliates using uploader_client.exe, a command-line tool that communicates with a hardcoded attacker-controlled server.
- The uploader supports five parallel connections per file, rotates connections after a default 2,048 MB, filters file types and uses a shared authentication key.
- In one observed case, operators targeted network-drive folders containing invoices and high-value PDFs.
- Before exfiltration, operators used security-disabling tools and vulnerable kernel drivers to terminate endpoint protection processes; PowerRun was used to elevate some tools.
- The reported intrusions involved AnyDesk for remote access and Mimikatz and NirSoft utilities for credential theft.
- Symantec characterizes the custom tool as a shift from commonly used utilities such as Rclone and MegaSync; it says the motivation for that shift is unknown.
- The article points to Symantec protection guidance and lists file hashes and an exfiltration endpoint for detection and response.
Article Details
- Attack Vectors
- Trigona affiliates used uploader_client.exe to exfiltrate selected files to a hardcoded attacker-controlled server.
- Before exfiltration, operators used tools and vulnerable kernel drivers to terminate endpoint-protection processes.
- Attackers gained remote access to infected machines using AnyDesk.
- Mimikatz and password-recovery utilities were used to harvest application and browser credentials.
- Defensive Notes
- The article directs readers to the Symantec Protection Bulletin for current protection updates; it does not provide more specific mitigation steps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 163[.]172[.]105[.]82 | Exfiltration command-and-control endpoint, listed with port 1080. |
| SHA256 | 0b679027e38f3d9ca554085be0e762c651e83e6414401b56635cdf3765ca1dac | Hash identified in the article's IOC list as AnyDesk used for remote access in the attacks. |
| SHA256 | 0ce7badb26174b6129fb13d7e255e582f84d8aaedeabcd02c80d84a609144068 | Hash identified in the article's IOC list as PCHunter, deployed among security-disabling tools. |
| SHA256 | 1433aa8210b287b8d463d958fc9ceeb913644f550919cfb2c62370773799e5a5 | Hash of wktools.sys, identified as a vulnerable driver used to impair defenses. |
| SHA256 | 1588023393eb6b4d9433d539d303ecb56b6c3630e860f94d1a137834bdedf2bd | Hash identified in the article's IOC list as PCHunter, deployed among security-disabling tools. |
| SHA256 | 205818e10c13d2e51b4c0196ca30111276ca1107fc8e25a0992fe67879eab964 | Hash identified in the article's IOC list as Remote DesktopPassView, among the password-recovery utilities observed. |
| SHA256 | 207b11f7dc4f17e4e5a9c25dbfb6a785a7456d7c381ecea7c729d8d924be1fb9 | Hash identified in the article's IOC list as PCHunter, deployed among security-disabling tools. |
| SHA256 | 274ca13168b38590c230bddc2d606bbe8c26de8a6d79156a6c7d07265efe0fdf | Hash identified in the article's IOC list as PCHunter, deployed among security-disabling tools. |
| SHA256 | 396aa1f8f308010a3c76a53965d0eddd35e41176eacd1194745d9542239ca8dc | Hash identified in the article's IOC list as the custom exfiltration uploader. |
| SHA256 | 4a44d0c6cf5de515dd296f05ff6674d1a340fccf6b4c11612d27be2d3baa82b0 | Hash identified in the article's IOC list as PCHunter, deployed among security-disabling tools. |
| SHA256 | 4adbb1906762c757764ffc5fa64af96e091966f4f5a43aae12fcc4f05f1c26b5 | Hash identified as StpProcess Monitor BYOVD, one of the security-disabling tools listed in the article. |
| SHA256 | 598555a7e053c7456ee8a06a892309386e69d473c73284de9bbc0ba73b17e70a | Hash identified in the article's IOC list as Dialup Pass, among the password-recovery utilities observed. |
| SHA256 | 5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd | Hash identified in the article's IOC list as Mailpassview, among the password-recovery utilities observed. |
| SHA256 | 647b2f12486343fe065dc4abbb11e2338589eb099c72792b5a05e64a5e2937fc | Hash identified in the article's IOC list as YDarkDriver, associated with the security-disabling activity. |
| SHA256 | 6688fb3039ad6df606d76a897ef1072cdc78b928335c6bfa691d99498caf5c4b | Hash identified in the article's IOC list as Mimikatz, used for credential theft. |
| SHA256 | 6ce228240458563d73c1c3cbbd04ef15cb7c5badacc78ce331848f5431b406cc | Hash identified in the article's IOC list as HRSword, used as a kernel driver service during defense impairment. |
| SHA256 | 72fc3d03065922b9a03774bbd1873e5e7f3a5a2abf5dcf7bfb2e98aceed53a9d | Hash identified in the article's IOC list as AnyDesk used for remote access in the attacks. |
| SHA256 | 73cd405b5bfc99ec5cf33467d4be7fc7e39ae18337568ee10173c17ba6e8f0d7 | Hash identified in the article's IOC list as AnyDesk used for remote access in the attacks. |
| SHA256 | 7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26 | Hash identified in the article's IOC list as MessengerPass, among the password-recovery utilities observed. |
| SHA256 | 816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019 | Hash identified in the article's IOC list as VNCPassView, among the password-recovery utilities observed. |
| SHA256 | 87bf4b152d9548f415f12f353f988b5442729e7f24e2902ddfd0baa4a944354a | Hash identified in the article's IOC list as DumpGuard, deployed among security-disabling tools. |
| SHA256 | 8a2f4907159a68867b22bc772590ebcafcfa656a23951228ecd89e4f598472b0 | Hash identified in the article's IOC list as DumpGuard, deployed among security-disabling tools. |
| SHA256 | 99c4775ed813f354c9e53f42797226d82b26f44d19e81036c9e55222d1744189 | Hash identified in the article's IOC list as HRSword, used as a kernel driver service during defense impairment. |
| SHA256 | b066ca2702853c2fcbf686897c18f6d315be7ae753007ac2c1d73c87b0a30de9 | Hash identified as PowerRun, which attackers used to execute some security-disabling tools with elevated privileges. |
| SHA256 | b3774ba01a3096348fd76a7072407b9f07bb9589e0f5ba31ca576689bbbe94e4 | Hash identified in the article's IOC list as HRSword, used as a kernel driver service during defense impairment. |
| SHA256 | c41216eee9756a1dcc546df4fe97defc05513eed64ce6ac05f1501b50e6f96cc | Hash identified in the article's IOC list as Webbrowserpassview, among the password-recovery utilities observed. |
| SHA256 | c64964944b4c1f649ae8f694964b3a212dc1028341ab71836306a456fba0b3f4 | Hash identified as a vulnerable ke64.sys driver in the article's IOC list. |
| SHA256 | d4339a5b9d15211dbc85424cf7fa8ff825033ea3378506d8ecb19b016db5b4ff | Hash identified in the article's IOC list as YDark, one of the tools deployed to disable security. |
| SHA256 | e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173 | Hash identified in the article's IOC list as Gmer, deployed among security-disabling tools. |
| SHA256 | f27eab3157451e31db71169e71f76d28325193218f9dc8f421136d4a20165feb | Hash identified in the article's IOC list as WKTools, deployed among security-disabling tools. |
| SHA256 | f5390674f0f49fe8af116396828c3de6729347ebc3c772d87618e55629aec06c | Hash identified in the article's IOC list as Ydark, one of the tools deployed to disable security. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe article reports credential theft using Mimikatz.T1039 · Data from Network Shared DriveThe uploader targeted folders containing invoices and high-value PDFs stored on networked drives.T1041 · Exfiltration Over C2 ChannelThe custom uploader was used to send stolen files to its hardcoded attacker-controlled server.T1215 · Kernel Modules and ExtensionsThe article reports installation and use of kernel drivers, including HRSword as a kernel driver service, to impair defenses.T1219 · Remote Access ToolsAttackers used AnyDesk to gain remote access to infected machines.T1562.001 · Disable or Modify ToolsOperators used tools and drivers to terminate endpoint-protection processes before exfiltration.
Threat Actors
Malware
Products
Tools
Dialup Pass598555a7e053c7456ee8a06a892309386e69d473c73284de9bbc0ba73b17e70a – Dialup Pass DumpGuarddisabling of security products via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credential theft with Mimikatz, indicatingGMERincluded pre-exfiltration disabling of security products via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credential theft withHRSwordThe intrusions included pre-exfiltration disabling of security products via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, andMailPassView5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd – Mailpassview MessengerPass7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26 – MessengerPass MimikatzWKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credential theft with Mimikatz, indicating elevated technical maturity by the Trigona/Rhantus actors.PCHunterincluded pre-exfiltration disabling of security products via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credentialPowerRun[T1548 ] Abuse Elevation Control Mechanism – PowerRun was used to execute tools with elevated privileges to facilitate disabling protections (‘PowerRun was used to execute some of these tools with elevated privileges.’)Remote DesktopPassView205818e10c13d2e51b4c0196ca30111276ca1107fc8e25a0992fe67879eab964 – Remote DesktopPassView StpProcessMonitorByovdproducts via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credential theft with Mimikatz, indicating elevated technicaluploader_client.exeSymantec observed Trigona ransomware affiliates in March 2026 using a custom exfiltration tool, uploader_client.exe, that communicates with a hardcoded attacker-controlled server and supports parallel streams,VNCPassView816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019 – VNCPassView WebBrowserPassViewc41216eee9756a1dcc546df4fe97defc05513eed64ce6ac05f1501b50e6f96cc – Webbrowserpassview WKToolsdisabling of security products via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credential theft with Mimikatz,YDarkpre-exfiltration disabling of security products via kernel drivers and tools (HRSword, PCHunter, Gmer, YDark, WKTools, DumpGuard, StpProcessMonitorByovd), remote access with AnyDesk, and credential theft with