TridentLocker is a ransomware-as-a-service (RaaS) operation that emerged in late 2025, utilizing double-extortion tactics to pressurize victims for financial gain. The group encrypts systems while threatening to release stolen data, demonstrating sophisticated operational security and a rapid pace of attacks across various sectors.
Key insights
•Employs double-extortion tactics by encrypting systems and threatening to leak stolen data.
•Gains initial access through credential abuse and privilege escalation techniques.
•Targets a diverse range of sectors, indicating a broad operational focus.
•Utilizes proprietary ransomware while engaging in data exfiltration prior to encryption.
•Demonstrates high operational security, allowing prolonged undetected presence within networks.