Research page reference

Archived note files

1 supported · 0 skipped
Trinity ransomware note files
Original filenameFile typeContent hashSourceInternal archive
README.txt Plain text (.txt) 4a8041152ed0ce50… Upstream file Read archived source

Negotiation records

Threat actor page: trinity

An explicit archive alias maps the ThreatLabz family Trinity to the Ransomchats actor label trinity. Note and negotiation counts remain separate.

Negotiation records explicitly mapped to Trinity
Participants Source Archive status
Not recorded 0001 2 trinity, victim JSON Indexed
Not recorded 0002 52 trinity, victim JSON Indexed
Not recorded 0003 286 trinity, victim JSON Indexed
Not recorded 0004 166 trinity, victim JSON Indexed
Not recorded 0005 14 trinity, victim JSON Indexed
Not recorded 0006 10 trinity, victim JSON Indexed
Not recorded 0007 36 trinity, victim JSON Indexed
Not recorded 0008 13 trinity, victim JSON Indexed
Not recorded 0009 6 trinity, victim JSON Indexed
Not recorded 0010 7 trinity, victim JSON Indexed
Not recorded 0011 48 trinity, victim JSON Indexed
Not recorded 0012 15 trinity, victim JSON Indexed
Not recorded 0013 32 trinity, victim JSON Indexed
Not recorded 0014 5 trinity, victim JSON Indexed

Dataset provenance and citation

Stable family archive information
Upstream collectorZscaler ThreatLabz
Source repositoryThreatLabz/ransomware_notes
Source directorytrinity
Snapshot commit2bbf5b4ecda84837c4a71af1a99c6821920f051a
Dataset snapshotJun 26, 2026, 10:27 PM
Synchronization timeJul 22, 2026, 11:47 AM
Source statusComplete
LicenseMIT; preserved notice
Stable internal citationextortion.wiki. Trinity ransomware notes. ThreatLabz/ransomware_notes snapshot 2bbf5b4ecda84837c4a71af1a99c6821920f051a. https://extortion.wiki/notes/trinity/.