TridentLocker
A double extortion ransomware group that emerged in late November 2025. It is reported to target organisations holding regulated or third-party data, including government service providers.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
TridentLocker's reported interest is data held for others. Malpedia says it targets organisations handling large volumes of regulated or third-party data, such as government services and telecoms providers, and uses a leak portal with detailed profiles and countdown timers.2
Two claims were followed by confirmation of an incident. At the start of January 2026, a US government services contractor confirmed an incident at a subsidiary, saying it was segmented from the rest of the business.3 A European postal operator also later confirmed a data breach after a claim by the group.3
The sources we reviewed do not establish a UK link.
Segmentation appears to have limited the reported impact in the contractor case, on that firm's own account. We would check that any environment holding client data is equally separated.
Vulnerabilities
The sources we reviewed name no CVE. Malpedia refers only to unpatched software.2
Defences That Matter
Protect Identity and Patch
- Use MFA on remote access and remove old credentials.
- Patch internet-facing software, given the reported use of unpatched software.
Segment Client Data
- Keep environments holding regulated or client data separate from the rest of the business.
Plan the Response
- Keep offline backups and test them.
- Rehearse notifying clients and regulators after a leak claim.
Is Your Client Data Properly Segmented?
We can help you test segmentation and plan your response to a data leak claim.