Trigona Ransomware Attacks MS-SQL Servers Using Rust Scanner and BCP Utility to Deploy Payloads

The ASEC has published a report revealing that the Trigona ransomware threat actors are still targeting Microsoft SQL servers, expanding their toolkit with Rust-based scanners, remote access tools, and privilege escalation utilities. According to AhnLab researchers, the group is attacking MS-SQL servers exposed to the internet by brute-force or dictionary attacks, then deploying a CLR shell to run system commands and install additional payloads.

The attackers use the Bulk Copy Program (BCP) to store malware in SQL tables and then export it as executable files to the infected host, with sample commands showing malware stored in the table uGnzBdZbsi and exported to local paths. In addition to BCP, they rely on curl, Bitsadmin, and PowerShell to download malicious executables, and they frequently abuse AnyDesk to control infected systems, often alongside remote desktop protocol logins created under names such as Remote99 or Ladmin.

The operation also introduces a new downloader built with Bat2Exe to install an external MSI package suspected of deploying the Teramind remote monitoring tool, while a Rust-written scanner identifies vulnerable RDP and MS-SQL endpoints across the internet. As part of prior and current activity, the group uses Go-based StressTester for SQL injection and HTTP requests, and aims to maintain persistence using remote management tools.