Trigona Ransomware Attacking MS-SQL Servers

AhnLab Security Emergency response Center (ASEC) has recently discovered the Trigona ransomware being installed on poorly managed MS-SQL servers. Trigona is a relatively recent ransomware that was first discovered in October 2022, and Unit 42 has recently published a report based on the similarity between Trigona and the CryLock ransomware. [1]

1. Poorly Managed MS-SQL Servers

Poorly managed MS-SQL servers typically refer to those that are exposed to external connections and have simple account credentials, rendering them vulnerable to brute …

account actor ahnlab asec attacks center connections control credentials crylock emergency exposed external log malware analysis managed ms-sql october ransomware report response security servers similarity simple sql sql servers threat threat actor trigona trigona ransomware unit 42 vulnerable