THREAT ACTOR
TRIGONA_
DormantTRIGONA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of TRIGONA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2024 19
- 2023 33
Leak site mirrors
10 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
6n5tfadusp4sarzuxntz34q4ohspiaya2mc6aw6uhlusfqfsdomavyyd.onionBlog snapshot · 2023-06-26 12:09 -
trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onionTrigona is Gone snapshot · 2023-10-18 10:06 -
trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion404 Not Found snapshot · 2023-10-18 10:06 -
krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onionBlog snapshot · 2024-04-10 23:02 -
krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onionsnapshot · 2024-04-10 23:02 -
zp6la4xdki3irsenq3t7z7pu2nnaktqgob6aizlzjkdiyw6azjeuhzqd.onionBlog snapshot · 2024-03-01 14:02 -
3x55o3u2b7cjs54eifja5m3ottxntlubhjzt6k6htp5nrocjmsxxh7ad.onionsnapshot · 2024-12-10 23:30 -
znjkde7j35jed5qqz3sfiv56v6hyfkbluke5ypi2su5vhx2nruswjcad.onionsnapshot · 2025-01-25 03:03 -
aeey7hxzgl6zowiwhteo5xjbf6sb36tkbn5hptykgmbsjrbiygv4c4id.onionsnapshot · 2025-01-25 03:06 -
znuzuy4hkjacew5y2q7mo63hufhzzjtsr2bkjetxqjibk4ctfl7jghyd.onionsnapshot · 2025-02-18 16:21
Recent victims
The 50 most recent victims claimed by TRIGONA. Total in the index: 52.
| Date listed | Victim | Description |
|---|---|---|
| 2024-03-30 | Claro | Claro, a subsidiary of América Móvil (http://krsbhaxbki6jr4zvwblvkaqzj… |
| 2024-03-20 | South Star Electronics | South Star Electronics Co., Ltd. is a prominent electronics company ba… |
| 2024-03-16 | Indoarsip | Indoarsip is a leading provider of archival solutions, dedicated to pr… |
| 2024-03-16 | Bwizer | Bwizer is a prominent entity known for its dedication to advancing the… |
| 2024-03-16 | Topa Partners | Topa Electrical, led by Electrical Inspector Jeff Zhao, boasts a rich … |
| 2024-03-15 | ATMCo | ATMCo is a reputable tax management company based in Broken Arrow, Okl… |
| 2024-02-29 | Dinamic Oil | Established in 1970, Dinamic Oil S.p.A. is a renowned Italian manufact… |
| 2024-02-28 | Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, Pension Alemana | Welcome to the Boutique Hospitality Collection, where every property o… |
| 2024-02-14 | FALCO Electronics | Founded in 1991, Falco Electronics is a prominent designer and manufac… |
| 2024-02-14 | America Movil | América Móvil, S.A.B. de C.V. ("América Móvil" or "the Company") stand… |
| 2024-01-30 | Ausa | AUSA, established in 1956 by four visionary individuals driven by a pa… |
| 2024-01-30 | Genesis Motors | Genesis Motors Isuzu UTE, situated in Lilydale, South East Melbourne, … |
| 2024-01-30 | CMG Drainage Engineering | Established in 1986, CMG Drainage Engineering stands as a prominent Ci… |
| 2024-01-30 | Daher Contracting | Daher Contracting stands as the foremost excavation and site developme… |
| 2024-01-29 | Lomma Crane & Rigging | J.F. Lomma, Inc. is a distinguished provider of crane services, offeri… |
| 2024-01-19 | Samuel Sekuritas Indonesia & Samuel Aset Manajemen | PT Samuel Sekuritas Indonesia (SSI) is a prominent financial advisory … |
| 2024-01-19 | Premier Facility Management | Premier Facility Management (PFM) stands as a leader in sustainable gr… |
| 2024-01-19 | Fertility North | Fertility North, a leading fertility clinic, boasts a cohesive, multid… |
| 2024-01-19 | Vision Plast | Founded in 2006, Vision Plast Group stands as a prominent player in th… |
| 2023-10-13 | Alconex Specialty Products | Founded in 1987, Alconex Magnet Wire is a renowned company specializin… |
| 2023-10-12 | FPZ | |
| 2023-10-01 | Quest International | |
| 2023-09-29 | New data leak. IT company from California | |
| 2023-09-20 | Portesa | |
| 2023-09-18 | Grupo Boreal | |
| 2023-09-15 | Steelforce | |
| 2023-09-05 | Cazalys | |
| 2023-09-05 | Treadwell, Tamplin & Company, Certified Public Accountants, Madison, GA | |
| 2023-09-05 | Flamingo Holland | |
| 2023-09-05 | Aria Care Partners | |
| 2023-09-05 | Cedar Holdings | |
| 2023-09-05 | Unimed | |
| 2023-09-05 | Cyberport | |
| 2023-06-06 | Public Health Management Corporation | Public Health Management Corporation (PHMC) is a non-profit organisati… |
| 2023-06-01 | Pacific Union College | Pacific Union College (PUC) is a private, Seventh-day Adventist colleg… |
| 2023-05-26 | Marshall Construction Ltd | Marshall Construction Ltd is a construction company established in 199… |
| 2023-05-25 | Leidos | Leidos Holdings, Inc. is an American defense, aviation, information te… |
| 2023-05-22 | Technology and Telecommunications Consultants Inc | Technology and Telecommunications Consultants Inc (TTC) is a US-based … |
| 2023-05-19 | Rolser | Rolser is a Spanish company that manufactures and sells a wide range o… |
| 2023-05-18 | Lolaico Impianti | Lolaico Impianti is a leading engineering and construction company bas… |
| 2023-05-16 | Feit Electric | Feit Electric is a leading lighting manufacturer and distributor in Ca… |
| 2023-05-15 | Accudo Investments LTD | Accudo Investments LTD is a private limited company registered in the … |
| 2023-05-13 | TTCCPA | Treadwell Tamplin is an accounting firm that provides a range of finan… |
| 2023-05-11 | Axiom Professional Solutions | Axiom Professional Solutions providing comprehensive recruiting, place… |
| 2023-05-09 | Fresh Insurance IT Services | Fresh Insurance IT Services is a UK-based company that specializes in … |
| 2023-05-04 | Treadwell, Tamplin & Company, Certified Public Accountants, Madison, GA | Treadwell Tamplin is an accounting firm that provides a range of finan… |
| 2023-04-18 | Amouage | Amouage is a High Perfumery House renowned for creating some of the mo… |
| 2023-04-18 | Winter Park Construction | Winter Park Construction (WPC) is a well-established company that has … |
| 2023-04-18 | Office Notarial de Baillargues | L’Office Notarial de Baillargues is a notarial office that provides le… |
| 2023-04-18 | Albany Clinic | Albany Clinic is a medical center that provides family doctors, specia… |
CONFIRMED ATTACKS
Trigona confirmed attacks: 7 verified incidents
Ransomnews has verified 7 Trigona incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2023 to March 2024. United States accounts for 2 of them (29%), with victims recorded in 5 countries in total. The most affected sector is government, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 6. Where a figure was disclosed (3 cases), these incidents account for 141,988 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Trigona incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2024 | South China Athletic Association | Other | Causeway Bay, Hong Kong | 72,315 | Unknown | Source |
| January 2024 | Claro Company (América Móvil) | Utilities | Mexico City, Mexico | — | Unknown | Source |
| September 2023 | Portesa, Porcino de Teruel SA | Food and Beverage | Teruel, Spain | — | Unknown | Source |
| August 2023 | Cyberport | Government | Pok Fu Lam, Hong Kong | 13,632 | No | Source |
| March 2023 | Office Notarial de Baillargues | Government | Baillargues, France | — | Unknown | Source |
| March 2023 | Pacific Union College | Education | California, United States | 56,041 | Unknown | Source |
| March 2023 | Treadwell, Tamplin & Co., CPA's, LLP | Finance | Georgia, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Trigona's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.