Ransomware group

Trinity ransomware: victims and leak site activity

The Trinity ransomware group has listed 18 victims on its leak site since June 2024; its latest post is from 16 March 2025. Most affected countries: United States, Canada and Spain. Most targeted sector: Professional Services.

Total posts 18
First seen 2024-06-11
Latest post 2025-03-16
Countries hit 9

About Trinity

Trinity ransomware was first discovered in May 2024, believed to be a rebrand of the Venus/2023Lock variants, using ChaCha20 encryption and double-extortion via a Tor leak site; the US HHS flagged it as a specific threat to the healthcare sector after confirmed attacks on healthcare organizations.

Leak site (Tor)
http://txtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion/articles

Trinity victims per year

11 2024
7 2025

All 18 victims

Search every post in the full table.
Victim Country Sector Discovered
Kairav Chemofarbe Industries India Manufacturing
consultoria-consultores.es Spain Professional Services
ROBONG-WINMINI
Lake Psychological Services United States Healthcare
CANAM Realty Group United States Professional Services
CNS China Healthcare
la-z-boy United States Retail & E-Commerce
Agencia Tributaria AEAT Spain Government & Defense
Barnes & Cohen United States Professional Services
FoccoERP Brazil Technology
Fabrica Industrial Machinery & Equipment Argentina Manufacturing
INTERNAL.ROCKYMOUNTAINGASTRO.COM United States Healthcare
welland Canada Professional Services
Cosmetic Dental Group Jersey Healthcare
Banner and Associates United States Professional Services
sgvfr.com United States Financial Services
CBSTRAINING Canada Professional Services
filmetrics corporation Philippines Technology