Trinity
Trinity ransomware was first discovered in May 2024, believed to be a rebrand of the Venus/2023Lock variants, using ChaCha20 encryption and double-extortion via a Tor leak site; the US HHS flagged it as a specific threat to the healthcare sector after confirmed attacks on healthcare organizations.
Victims
18
First Discovered
2024-06-11
victim
Last Discovered
2025-03-16
victim
Inactive Since
1yr
more than
Avg Delay
5
days
Infostealer
23.5%
victims with domain
Countries
9
hit
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
rans | No | 2026-04-28T07:21:56 |
txtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion
|
Target
Top 5 Activity Sectors
- Business Services 6
- Healthcare 3
- Manufacturing 2
- Technology 2
- Consumer Services 1
Top 5 Countries
-
United States
7
-
Spain
2
-
Canada
2
-
India
1
-
China
1
Heatmap
Ransom Notes (1)
Negotiation Chats (14)
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Email
1
| Type | IOC |
|---|---|
Email
|
helpdesk101@onionmail.com
|
Victims (18)
[AI generated] Kairav Chemofarbe Industries Ltd is a pharmaceutical company based in Mumbai, India. …
[AI generated] CANAM Realty Group is a full-service real estate company based in Arizona, United Sta…
Data base 20+tb - Revenue: $ 59.2 Million - Publication date: 2024-10-23…
330Gb - Revenue: $60.3 Million - Publication date: 2024-10-16…
full data base(1,5 TB) - Revenue: $7.6 Million - Publication date: 2024-09-20…
