Trigona ransomware is using a custom command-line tool named 'uploader_client.exe' for data exfiltration. The tool connects to a hardcoded server address and features: support for five simultaneous connections per file for faster parallel uploads, rotation of TCP connections after 2GB of traffic to evade monitoring, selective file type exfiltration excluding large low-value media files, and use of authentication keys to restrict access. The attack chain includes installing Huorong Network Security Suite tool HRSword as a kernel driver service, followed by deploying tools to disable security products using vulnerable kernel drivers. PowerRun is used to execute utilities with elevated privileges, AnyDesk for remote access, and Mimikatz/Nirsoft utilities for credential theft and password recovery.