The U.S. Department of HHS has warned about a relatively new threat actor dubbed as Trinity ransomware that known for employing a double extortion strategy.
Initially seen around May 2024, Trinity ransomware is a type of malicious software that infiltrates systems through several attack vectors, including phishing emails, malicious websites, and exploitation of software vulnerabilities. Threat actors involve exfiltrating sensitive data before encrypting files, thereby increasing pressure on victims to pay the ransom.
There are seven Trinity ransomware victims identified to date. Of these, two victims have been identified as healthcare providers, one based in the U.K., and the other a U.S.-based gastroenterology services provider, where Trinity claims to have access to 330 GB of the organization’s data.
HHS said that Trinity’s has similarities with other ransomware variants, such as 2023Lock and Venus, suggests a potential link or collaboration among threat actor groups. This collaboration could lead to the exchange of techniques, tools, and infrastructure, amplifying the scale and sophistication of future ransomware campaigns.
- Upon installation, Trinity ransomware begins gathering system details such as the number of processors, available threads, and connected drives to optimize its multi-threaded encryption operations.
- It will attempt to escalate its privileges by impersonating the token of a legitimate process. This allows it to evade security protocols and protections.
- It performs network scanning and lateral movement, indicating its ability to spread and carry out attacks across multiple systems in a targeted network.
Once inside the system, Trinity ransomware employs a double extortion strategy to target its victims. It seems to exfiltrate the victim’s data before initiating encryption. It encrypts the victim’s files using a robust encryption algorithm, rendering them unusable without the correct decryption key. The ransomware typically appends the ‘.trinitylock’ file extension to the affected files, making it clear which ones have been compromised.
Threat actors use a symmetric encryption algorithm that utilizes a 256-bit key for encrypting and decrypting data. After the encryption process is complete, Trinity ransomware generates a ransom note, in both text and .hta formats, and adjusts the desktop wallpaper via a registry modification. The ransom note is often placed on the desktop or within directories containing the encrypted files. This note contains instructions provided by the threat actor (TA), their onion site URL, and the email address for communication.
Trinity’s ransom note informs victims that their files have been encrypted and that personal data and databases have been extracted. The attacker then demands a ransom payment in cryptocurrency in exchange for the decryption key. Victims have 24 hours to contact the cybercriminals, and failure to do so will result in the stolen data being leaked or sold.
The ransomware operators uses both a support and data leak site. The support site allows victims to upload a sample file that is less than 2MB in size for decryption.
Strategies to strengthen Defense
- Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location.
- Adopt network segmentation and maintaining offline backups of data to ensure limited interruption to the organization.
- Regularly data backup and password-protect backup copies offline; and ensuring copies of critical data are not accessible for modification or deletion from the system where the data resides.
- Install and regularly update antivirus software on all hosts and enable real-time detection.
- Install updates/patch operating systems, software, and firmware as soon as they are released.
- Enforce multi-factor authentication
- Zero Trust or a VPN solution should present for accessing the assets over the internet
Indicators of Compromise
- MD5 949c438e4ed541877dce02b38bf593ad
- SHA1 4c58d2d624d9bdf6b14a6f8563788785074947a7
- SHA256 36696ba25bdc8df0612b638430a70e5ff6c5f9e75517ad401727be03b26d8ec4
TTP
