ExfilSquadThreat actor
ExfilSquad is an emerging data-extortion group that surfaced on July 26, 2026, operating a Tor-hosted Data Leak Site to publicly claim data theft from 15 organizations, including Microsoft. Their model focuses on public exposure and pressure tactics without confirmed encryption, lacking evidence of a Ransomware-as-a-Service structure or specific initial-access methods.From MISP Galaxy
Last reported 17 days ago, by Infosecurity Magazine6 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“…K police and justice staff on the dark web hands cybercriminals a readymade directory to launch highly targeted spear-phishing and social engineering attacks against the very people defending our justice system."”
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
- T1219Remote Access Tools
“Attackers escalated privileges, established persistence via legitimate remote access tools, and in the most advanced case deployed DragonForce ransomware, resulting in environment-wide encryption.”
- T1505.003Web Shell
“Activity spanned over 100 countries and led to confirmed compromises, including administrative takeovers and web shell deployments, enabling follow-on access and potential credential theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Telegram Account Behind ASOS Rogue Notification Tied to Gaming Trading“…e highlighted that all of these techniques have been repeatedly leveraged by other data extortion cybercriminals, such as FulcrumeSec, ExfilSquad, Scattered Spider, and Lapsus$, to target UK organizations over the last couple years.”
-
Cyber Brief 26-08 - July 2026“ExfilSquad data theft from UK Department of Education support portals”
-
Cyber Brief 26-09 - August 2026“ExfilSquad listed PNLD, but attribution was not confirmed.”
-
July 2026 Ransomware Trend Report“… INC Ransom, and Coinbase Cartel continued their activities, while new data-stealing and ransomware groups—including Gammax, SECTION9, ExfilSquad, Shiba, GLOBAL SECRET GROUP, D1R, The Crypt Apados, CRPx0, and Doommageddon also emerged as new data theft and ransomware groups.”
-
Researchers Confirm ExfilSquad’s Access to Sensitive Data Across 13 Organizations“Researchers Confirm ExfilSquad’s Access to Sensitive Data Across 13 Organizations”
-
UK’s Police National Legal Database Reveals Data Breach“ExfilSquad Claims Responsibility for PNLD Hack”
Indicators in its reports
named in the reports above- cert[.]lvin 1 report
- atlantaga[.]govin 1 report
- education.gov[.]ukin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.