Trinity is a ransomware group targeting the healthcare sector with double-extortion tactics.
Trinity ransomware emerged in May 2024, likely a rebrand of the Venus/2023Lock variants, employing ChaCha20 encryption and double-extortion via a Tor leak site. The US HHS has flagged it as a specific threat to the healthcare sector following confirmed attacks. Operators focus on healthcare organizations and leverage ransomware-as-a-service TTPs with data exfiltration before encryption. Defenders should prioritize offline backups for patient-critical systems and monitor for signs of lateral movement and unauthorized data egress leading to double-extortion.
Trinity ransomware was first discovered in May 2024, believed to be a rebrand of the Venus/2023Lock variants, using ChaCha20 encryption and double-extortion via a Tor leak site; the US HHS flagged it as a specific threat to the healthcare sector after confirmed attacks on healthcare organizations.
The Trinity ransomware group primarily targets the healthcare sector and has been flagged as a specific threat to this sector by the US Department of Health and Human Services.
Trinity ransomware uses ChaCha20 encryption and employs double-extortion tactics via a Tor leak site.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.