Ransomware: “Trigona”

Actions Preventing ‘Trigona’ Attack

Firewall

1. Enable your firewalls as well as intrusion detection and prevention systems.
2. Ensure latest signature has been applied on IPS.
3. Proactively monitor and validate the incoming and outgoing traffic of the network for any unauthorized attempts to the systems.
4. For Palo Alto firewall:  can also follow the “Product Protection Guide” in Bee-Ware of Trigona, An Emerging Ransomware Strain.

Clients & Servers

1. Ensure the system has up-to-date operating systems (OS) and software updates.
2. Ensure up-to-date anti-virus signatures from your anti-virus software such as Kaspersky or Windows Defender updated and perform scanning regularly.
3. Backup critical and important files regularly and keep them in offline or separate location, and test the backup restoration process to verify reliability.
4. Implement network segmentation to isolate critical systems and limit lateral movement within the network.
5. Beware of phishing emails and DO NOT open email/attachments from unknown/untrusted source.
6. Ensure all accounts with strong and different password and enable 2FA.
7. Review the user accounts regularly.
8. Disable unused ports and services.
9. Disable command-line and scripting activities and permissions if possible.

Note: these are good security defense-in-depth recommendations for prevention of being infected, but these steps alone do not guarantee against infection.

As a Victim:

1. Disconnect the system from the network IMMEDIATELY.
2. DO NOT respond to any kidnapper by attempting payment and instead to report the incident to your departmental IT Support, ITSC and the Police.

• The Trigona threat actors achieved initial access via a combination of brute force attacks, purchasing credentials from initial access brokers (“IABs”), and exploitation of vulnerable public-facing applications.
• The threat actors would subsequently look to persist through various means.
• There are various open source and commonly used tools being leveraged by threat actors to perform their malicious activities. These include:
  • Advanced Port Scanner and SoftPerfect Network Scanner for network reconnaissance.
  • ScreenConnect, AnyDesk, SplashTop, and various other legitimate remote desktop applications for lateral movement.
  • Use of Mimikatz to gather passwords and credentials on the machines of the victims for lateral movement.
  • Cobalt Strike beacon deployed through PowerShell that was then used by the threat actor to run the ransomware executable.
  • Deployment of files that terminate anti-virus related services and processes, such as turnoff.bat.
• Perform data exfiltration and use a data wiper feature to hinder forensic analysis or destroy victims’ data.

• • FortiGuard Labs:  Ransomware Roundup – Trigona
  • Palo Alto Networks:  Bee-Ware of Trigona, An Emerging Ransomware Strain
  • Trend Micro:  An Overview of the Different Versions of the Trigona Ransomware
  • Zscaler:  zscaler.com/blogs/security-research/technical-analysis-trigona-ransomware
  • BeepingComputer:  Latest Trigona news
  • CISA: Stop Ransomware
  • HKCERT: Fight ransomware

Please visit here for more Information Security tips.