---
title: "Trigona: A ransomware wiper"
description: Trigona ransomware was first observed in June 2022. It has Windows and Linux versions operates as ransomware as a service.
canonical_url: https://www.acronis.com/en/tru/posts/trigona-a-ransomware-wiper/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

27 February 2024

# Trigona: A ransomware wiper

Trigona ransomware was first observed in June 2022. It has Windows and Linux versions and operates as ransomware as a service.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

## Summary

● PE32 file written in Borland Delphi.

● Designed as a console application, which supports a lot of arguments.

● Uses AES CBC to decrypt configuration.

● Uses AES OFB cipher to encrypt files.

● File names will be encrypted.

● Encrypted files will have ‘._locked’ extension.

## Introduction

Trigona ransomware was first observed in June 2022. It has Windows and Linux versions, which are similar in their functionality. On underground forums, threat actors announced the start of the affiliate program, meaning that Trigona operates as ransomware as a service. It provides a builder for different configurations, an admin panel for Tor browsers and proofs about the impossibility of file decryption. In October 2023, the UAC (Ukrainian Cyber Alliance) [hacked Trigona's data leak site](https://twitter.com/vx_herm1t/status/1714426955913744684) and wiped all their data. Despite this, Trigona is still targeting different organizations, as evidenced by their other leak site, which is still updated with new victims, as well as new samples, which were made after UAC defaced their site.

## Technical details

### Overview

The Trigona ransomware sample is a PE32 file, written in Borland Delphi. It contains several resources, including package data, manifest, string tables and an unreadable string resource: ‘CFGS’.

![Image 1: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/33fccf83845cd482afc28f65bf850e26.png)

### Execution

A Trigona sample contains a lot of commands, which can be passed to the command line.

![Image 2: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/c05e19ad23636c3f1903061fa1595336.png)

![Image 3: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/6b766d72a83ed8d14c72ba6ef1896bdf.png)

At the start of execution, Trigona loads the string resource “CFGS”. If this resource is missing, the malware attempts to load a _‘cfgs.txt’_ file in the same folder as the executable.

![Image 4: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/c31317b8082edd1deec824f5afaa925b.png)

This resource is twice encrypted with an AES CBC cipher. After reading a resource to the memory, the malware takes its first 32 bytes as a key and the next 16 bytes as IV and performs a decryption. The second decryption takes the key and IV from the previous result.

![Image 5: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/0a9ab8c48fa3f479a559b2fb9ac4200f.png)

This Rijndael AES algorithm was taken from the DCPcipher cryptographic component. It uses saved Rijndael substitution block(S-box) constants.

![Image 6: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/2585e7cae95564dd605f18f85740abb5.png)

Those constants are used to initialize the key.

![Image 7: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/a38ad846bdd3fa58e4d0a267e079379b.png)

The decoded configuration then stored in the memory. It contains a ransom note HTML code template, data leak site link, threat actor email, victim ID and a large number of file extensions.

![Image 8: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/6ce6e6f9e734bddfb08c3c5c8bee75f5.png)

To identify victims, Trigona uses two unique parameters. The first one is VID – victim ID, which is saved in the sample configuration. For this sample, it is “EMPRESA”. The second one is CID (computer ID), which is generated during execution by obtaining information about the processor, operating system version and computer name.

The sample contains a saved list of possible Windows versions:

![Image 9: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/1d83e8d8a1782449361db0469f068320.png)

Then the sample uses IsWOW64Process to figure out system architecture. All gathered system information then passed to the MD5 hash function to generate VID.

![Image 10: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/e235d58df2850e6090cc39f6949f766e.png)

The example of generated VID: 8B7F6BA2-5D44-D267918C.

Then the sample makes a few changes to the Register. It sets a new key with a random name and its own path to provide an autostart to itself:

_Computer\HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Run_

The sample also adds a key to exclude itself from the Background Activity Monitor scan:

_Computer\HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-3461203602-4096304019-2269080069-1000_

After the encryption process is finished, the sample executes some commands to disable recovery mode, change boot status policy and delete all shadow copies and backups using the “ShellExecuteW” function. If the _‘/!clear\_shadow’_ parameter was passed, the sample skips this section. Also, it can delete itself and shut down the machine.

![Image 11: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/796b33fa93a83b3e96eb37d38ad6b6d6.png)

### Debug mode and log file

Starting a program with the _‘/debug’_ parameter will enable console output using a lot of saved strings. This parameter cannot be used without the ‘_/p [folder path]’_ argument. At some point of execution, the sample asks to enter a command to proceed the execution. There are three possible commands here:

**nonstop** – continue execution in debug mode

**kill** – terminate process

**!debug** – stop debugging mode, continue execution

![Image 12: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/a91c5b90018a7be170fc1a869a0cd1ae.png)

The same output will be saved to the log file, if the program was executed with _‘/log\_f [log file path]’_ argument.

### File encryption

To encrypt file content, the sample uses AES Rijndael as for decrypting configuration, but in OFB mode. After creating encryption threads, it starts to search files to encrypt.

The searching process is dependent on the command line arguments. The default setting is to skip the _‘C:\Windows’_ folder to avoid system workability disruption, but it can be changed with the _‘/allow\_system’_ command. If the _‘/priority [file/folder path]’_ command was used, it first would encrypt pointed files or folders.

![Image 13: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/e5800eb6a67cd856c4361812c7554ea4.png)

The sample starts searching all logical drives from “A” to “Z” and obtains information about them. Also, it checks for the presence of network shares, which can also be encrypted.

![Image 14: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/ab4f7323ea895267ce0a4ead319e50c3.png)

Then sample then starts searching for files to encrypt. Even though the configuration contains a lot of saved file extensions, it doesn’t use them. The excluded list is saved straight in the sample and contains only three file names:

_'how\_to\_decrypt.txt'_

_'how\_to\_decrypt.HTA'_

_NTUSER.DAT_

The AES in OFB mode implementation was also taken from the DCPcrypt library. The master key is generated pseudo randomly and is one for all files.

![Image 15: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/74527ec5b7097be5611e092932822853.png)

The “._locked” extension will be appended to each encrypted file. The file name will be encrypted with the same AES OFB cipher, sometimes appending to in the “availible_for_trial.” string. The files with this string can further be decrypted free as a part of test decryption.

![Image 16: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/ea46f23cd284e025c4e7afedd3f5ca42.png)

By default, the sample encrypts the first 0x80000(524288 bytes) of the file, the other data will be saved.

![Image 17: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/ed093c6a05acec19cbfe9ff8da73b3d6.png)

At the end of each encrypted file, it also writes 698 bytes of Trigona data, which is the same for all encrypted files. Also, it appends one more block with different size and content for each file.

![Image 18: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/0364da234a84b4a797501585c7db03a8.png)

This data block starts with ‘S S S S’ string and contains a MD5 hash value of CID and VID, as well as other data, which was taken from configuration.

![Image 19: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/7c300a2c2313a343523b65c16bb2b2df.png)

### File eraser and free disk space wiper

The ‘/erase’ command will clear all file data. Similar to encryption, the first 524288 bytes of the file will be overwritten with ‘0x00’ bytes (full file overwriting available with _‘/full’_ parameter). Then the file name will be overwritten with the random one and ‘.erased’ extension will be added. Finally, this file will be deleted. If the folder was passed as an argument, the sample will first delete all files, and then the folder will be deleted too.

![Image 20: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/6d09fe4f4490043f04b175eb8434d2ec.png)

The _‘/wipe’_ command will wipe disk free space. The sample searches for logical drives similar to the encryption process and when the disk is found, it creates a ‘wipespace.sys’ file. Then it starts to write ‘0x00’ bytes to this file, 1048576 bytes per one write until the disk free space will end.

![Image 21: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/b0bb10d82c1f4d0204ed5dc97c5a4e11.png)

### Ransom note

The ransom note ‘how_to_restore_files.hta’ is dropped in each encrypted folder and opened at the end of execution.

![Image 22: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/3ebe8d25d8311899be772680272a6726.png)

It contains a data leak site for Tor browser and an email to contact actors. At the time of analysis, the data leak site has already gone offline. Also, it has a CID, VID and authentication key.

![Image 23: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/fbcf762593cb317b4d01b30bf216a460.png)

The authentication key has more than 3700 symbols, separated with “--START_OF_DATA--” AND “--END_OF_DATA--” strings:

![Image 24: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/41bd83fa380e1e4cee1d35dc576df444.png)

### Data leak site

While the link to the leak site from sample doesn’t work, [there is one known that is still online](http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion/).

This is a ‘Blog’ site, which contains a list of victims.

![Image 25: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/bc69e7f0736a1eec266034a6d2ff3812.png)

All of those victims have a different status. The fresh ones have the status ‘Preview’ and contain a timer until the data is leaked. On the company page, there are some stolen documents to prove that the data is valid. The ‘Sold’ status means that the victim paid the ransom and the ‘Leaked’ status means that data has already been leaked.

![Image 26: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/59a6d9229bafce7744050eaaae21877f.png)

## Conclusion

Being not very active in the attacks, Trigona still continues its operation. Using a double extortion scheme, they demand a ransom to decrypt files and prevent stolen data from being leaked. The analyzed sample contains many different parameters for testing purposes. By default, the sample encrypts the first 0x800000(524288 bytes) of the file with AES Rijndael in OFB mode, the other data will be saved. The full file content can be encrypted only if using ‘/full’ parameter. Besides encryption, the sample can erase files content and delete them, as well as wiping free disk space. It stores encrypted configuration in the resources, which is different for all samples. At the end, it deletes shadow copies and backup files, which makes system recovery impossible.

## Detected by Acronis

![Image 27: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/c00b2f2e325b1e01b47306dc9d7902c4.png)

![Image 28: Trigona: A ransomware wiper](https://staticfiles.acronis.com/images/content/09b08275f2f0d5ba9fd40e9f636c8225.png)

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)