Overview
Trinity is a ransomware operation with a focused targeting mandate: healthcare and medical research institutions. Active since early 2025, the group has listed victims from NHS-affiliated trusts, EU hospital systems, pharmaceutical research organisations, and medical device manufacturers. While Trinity lacks the scale of top-tier operations like RansomHub or Akira, its deliberate sector concentration makes it a persistent and specific threat to the healthcare vertical.
The group operates a conventional double extortion model — encrypting systems while exfiltrating data and threatening publication on a dedicated leak site if ransoms are not paid. The healthcare focus is not accidental. Medical records carry high resale value on criminal marketplaces, hospitals face intense pressure to restore operations quickly (emergency patient care cannot pause for extended recovery), and healthcare organisations in the UK and EU remain relatively under-invested in ransomware-specific defensive controls compared to financial services.
Victimology
Trinity’s documented victim set includes:
- NHS community and acute trusts in England (at least four confirmed leak site postings through mid-2026)
- Hospital groups in France, the Netherlands, and Germany
- A UK-based oncology research organisation
- A medical device manufacturer with operations in Scandinavia
The group has not publicly targeted US healthcare with the same intensity, which may reflect operational risk calculations around the FBI’s increased focus on US healthcare ransomware following the Change Healthcare incident. UK and EU targets may face longer law enforcement response windows.
Victim size skews toward mid-tier organisations — trusts and hospital groups with revenue in the £50M-£500M range. These organisations are large enough to have data of value and operational complexity that makes rapid recovery difficult, but not large enough to have the security investment of major teaching hospitals or NHS England central functions.
Technical Profile
Trinity uses a Rust-based encryptor — a development pattern consistent with several other groups that have moved from legacy C/C++ or .NET implementations to Rust for performance, cross-platform capabilities, and evasion resistance.
Encryption: AES-256-CBC for file content encryption. RSA-4096 for encrypting the per-victim AES key, which is embedded in the ransom note. There is no known public decryptor. Victims who have recovered have done so through backup restoration or ransom payment.
Extension: Encrypted files receive a .trinitylock extension. Ransom notes are dropped as README_Trinity.txt in each affected directory.
Initial access vectors: Observed across multiple incidents:
- VPN credential theft (often from infostealer logs purchased from initial access brokers)
- Phishing campaigns targeting clinical administrative staff with MedConnect-themed lures
- Exploitation of unpatched remote access infrastructure — Cisco ASA and Fortinet SSL VPN appliances have appeared in incident reports
Lateral movement: Standard credential-based lateral movement. The group has used:
- BloodHound/SharpHound for Active Directory enumeration
- PsExec and WMI for remote execution
- Rclone for data exfiltration to Mega.nz and rclone-managed endpoints
Healthcare-specific behaviours: Trinity has been observed specifically targeting clinical information systems — Electronic Patient Record (EPR) systems, PACS (radiology imaging), and pathology lab systems. Encrypting these systems maximises operational impact in a hospital environment because clinical staff cannot treat patients without access to patient histories and imaging.
Ransom Demands and Negotiation
Ransom demands observed in Trinity cases range from approximately £80,000 to £2.3 million, scaling with victim revenue and perceived ability to pay. Healthcare organisations are assessed to have a higher payment rate than other sectors because operational disruption has direct patient safety implications that create institutional pressure to pay.
The group has demonstrated awareness of NHS payment constraints. In at least two cases, demands were reduced significantly during negotiation — suggesting the group expects negotiation and prices initial demands accordingly. They operate a victim portal on a Tor hidden service, accessible via credentials included in the ransom note.
The group has followed through on data publication for non-paying victims, with medical records, patient data, staff HR information, and clinical research data posted to their leak site.
Reporting and Response
UK healthcare organisations should report Trinity ransomware incidents to:
- NHS England Cyber Operations (for NHS organisations): 0800 888 6723
- NCSC for significant incidents: report.ncsc.gov.uk
- Action Fraud: 0300 123 2040
- ICO within 72 hours if personal data has been compromised: ico.org.uk
The DSPT (Data Security and Protection Toolkit) requires NHS organisations to report qualifying cyber incidents as a contractual obligation regardless of whether law enforcement reporting is required.
Defensive Priorities for Healthcare
Prioritise EPR and PACS backup integrity. Clinical systems need tested, isolated backups. “Air-gapped” here means genuinely offline or immutable storage — S3 Object Lock with governance mode or tape-based backups that cannot be reached from Active Directory credentials.
VPN and remote access hygiene. The most common Trinity initial access vector is credential theft followed by VPN access. Enforce MFA on all remote access. Remove VPN access for users who do not need it. Audit remote access logs for off-hours access patterns.
Patch management for perimeter systems. Trinity has exploited known vulnerabilities in Cisco and Fortinet appliances. Remote access infrastructure should be patched within 7 days of critical severity advisories — this is a different cadence from internal systems and requires a separate process.
EPR network segmentation. Clinical information systems should not be reachable from general corporate endpoints via flat network architecture. Segment clinical systems behind firewall rules that restrict access to the endpoint types (clinical workstations) and accounts (clinical staff) that legitimately need access.
Trinity’s healthcare focus is not a coincidence and is unlikely to be temporary. The combination of sensitive data, operational criticality, and historically underfunded security programmes makes healthcare a consistently profitable sector for ransomware groups willing to tolerate the ethical and reputational dimensions of targeting hospitals.