Trigona ransomware operators have been observed using a new custom command-line tool for data exfiltration. This tool is optimized for speed and efficiency, allowing the group to steal massive datasets before detection. This highlights the ongoing trend of ransomware groups developing bespoke tooling to bypass generic EDR detection for common exfiltration utilities like Rclone. [Sources: BleepingComputer]