Number of victims named on top 20 ransomware data-leak sites
(Ref: ReliaQuest Quarterly Cyber-Threat Report : Ransomware & Data-Leak Extortion) 

Recent reported activities
•    By April 2023, Trigona began targeting compromised MSSQL servers by stealing credentials via brute force methods. 
•    In May 2023, researchers found a Linux version of Trigona that shared similarities with its Windows counterpart.
•    In June 2023, Trend Micro encountered a new version of Trigona ransomware, this time designed for Windows 64-bit platforms. This version implements additional command-line arguments that were not present with the Linux version and the original 32-bit version.
•    Trigona was found to be exploiting the ManageEngine vulnerability CVE-2021-40539 for initial access based on a report from Arete. In addition, the threat actors used previously compromised accounts by obtaining access from network access brokers. It uses a variety of tools for lateral movement, including Netscan and Splashtop (a legitimate remote access tool), which is used to drop further additional tools on a compromised machine.
•    Trigona encrypts files in infected machines using AES encryption, and adds a “._locked” file extension to those encrypted files. Furthermore, the ransomware contains an encrypted configuration in its resource section which is decrypted upon execution.

Our Recommendations
To safeguard systems against ransomware attacks, it is important to implement data protection protocols and establish backup and recovery procedures to ensure that data remains secure and can be restored in case of encryption or deletion.
•    Backup your data.  Perform frequent backups of your system and data.  The 3-2-1 backup strategy – encompassing redundancy, geographic distance and access where there are at least three copies of your data backed up, two local (on-site) but on different media / devices, and at least one copy off-site.
•    Cybersecurity awareness training.  To strengthen workforce awareness, regular, mandatory cybersecurity awareness training sessions will keep the workforce updated and informed about current cybersecurity threats. 
•    Keep systems and software updated.  Ensure your applications and operating systems have been updated with the latest patches.  Vulnerable applications and software are ready targets of most ransomware attacks.
•    Restrict code execution.  Where feasible, enforce access control for temporary or data folders to prevent code execution in order to limit spread of ransomware data encryption. 
•    Review permission-related practices.  Removing local administrative rights can deter ransomware from running on a local system and prevent any changes to the local system resources that the ransomware may be targeting for encryption.
•    Network controls such as firewalls should limit or block remote desktop protocol (RDP) and other remote management services which are known to be used to deploy ransomware.


In the event of a ransomware attack, consider the following immediate measures:
•    Isolate / Shutdown your system.  To prevent the spread of the ransomware, isolate or shut down the system believed to be infected.
•    Block network access to any identified command-and-control (C2) servers used by the ransomware operators.  Ransomware is often blocked from encrypting data without access to their C2 servers.
•    Notify authorities.  Consider informing authorities as appropriate.
•    Seek help. Consider engaging a competent incident response team to help with the containment and investigation.


How Ensign can help
Ensign will continue to monitor the developing landscape in Hong Kong and keep you informed of any additional recommendations. 

Ensign’s Digital Forensics and Incident Response service stands ready to aid in a possible incident or security breach.  If you suspect an incident or are experiencing a breach, please contact us at marketing@ensigninfosecurity.com.

Engage experts from the Advisory and Cyber Strategy teams who can assess the cyber risk of your organization’s attack surface, and security architecture to identify measures to enhance cybersecurity resilience.


Indicators of Compromise

References

Hong Kong tech hub Cyberport alerts police, privacy watchdog after reports of ransomware attack exposing 400GB of data (msn.com)

Head of Hong Kong consumer watchdog apologises for potential data leak affecting over 8,000 people, with US$500,000 ransom made by hackers (msn.com)

Consumer Council (Hong Kong) : 消委會黑客入侵｜員工客戶資料7小時予取予攜　消委會：不交贖金 (hk01.com)

https://www.itsc.cuhk.edu.hk/user-trainings/information-security-best-practices/ransomware-trigona/

Office of the Privacy Commissioner for Personal Data (PCPD) – Media Statement for Data Breach Incident of Consumer Council https://www.pcpd.org.hk/english/news_events/media_statements/press_20230921.html)

Office of the Privacy Commissioner for Personal Data (PCPD) – Media Statement for Response on the Cyberport’s Data Breach Incident (https://www.pcpd.org.hk/english/news_events/media_statements/press_20230913b.html)

IOC

https://www.trendmicro.com/en_za/research/23/f/an-overview-of-the-trigona-ransomware.html

https://unit42.paloaltonetworks.com/trigona-ransomware-update/

https://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware