Threat Actor
Rhantus
- First Reported
- Apr 23, 2026
- Latest Reported
- Apr 27, 2026
Reported Context (2)
- Name used in the article for threat actors linked to the Trigona ransomware; they were reported to use a custom data-exfiltration tool in attacks detected in March 2026. Weekly Cybersecurity Recap: Fast16, FIRESTARTER, Bitwarden CLI Attack and More
- Symantec identifies Rhantus as the cybercrime group operating the Trigona RaaS; the article reports that Trigona affiliates used the custom uploader and defense-disabling tools. Symantec Details Trigona Affiliates’ Custom Data Exfiltration Tool
CVE (3)
Malware (6)
People (1)
Threat Actors (3)
MITRE ATT&CK (9)
Vendors (4)
Products (7)
Tools (16)
Industries (2)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.