Ransomware Group intelligence
ExfilSquad
ActiveTrack ExfilSquad with 30 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
ExfilSquad is tracked by Breach House as a ransomware group with 30 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
13
- Leaked 13 100.0%
- Pending 0 0.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 2h ago | exfil5gqmbxrg6yky5aeitkdj7kfwxxjh3wxzrtlewjqi2x67o634iyd.onion |
Top Activity Sectors (7)
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue ExfilSquad, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: ExfilSquad executes malicious payloads through PowerShell scripts stored in temporary directories to stage ransomware deployment.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: ExfilSquad modifies Windows Registry Run keys and startup folders to maintain persistence across reboots.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: ExfilSquad disables Windows Defender and AV tools by terminating security processes and modifying service configurations to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: ExfilSquad deletes Volume Shadow Copy and backup artifacts via vssadmin commands to prevent recovery options.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: ExfilSquad uses file and directory discovery via PowerShell to enumerate critical data paths before targeting encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: ExfilSquad moves laterally through SMB/Windows Admin Shares using stolen credentials to compromise additional servers.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1041 Exfiltration Over C2 Channel Exfiltration
What they do: ExfilSquad exfiltrates stolen data via encrypted C2 channels using custom Python scripts over HTTPS endpoints.
What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: ExfilSquad encrypts victim files using AES-256 encryption with custom keys applied to corporate directories and databases.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: ExfilSquad inhibits system recovery by corrupting restore points and disabling backup service processes during impact phase.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (30)
Search, filter and paginate the victim timeline for ExfilSquad. Showing 1–30 of 30.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Wesco International id30937 View details | United States | Manufacturing / Engineering | — | leaked | |
|
Wesco International is a leading provider of business-to-business distribution and supply chain services, operating in the manufacturing and engineering sector in the US. The company offers a wide range of products and services to its customers. Wesco International was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | Wesco International id30937 View details | United States | Manufacturing / Engineering | — | leaked | |
|
Revenue: $24B DATA SUMMARY: 2.6M~ records containing: customer and employee PII, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access information. |
||||||
| Ransomware | Analog Devices id30862 View details | United States | Manufacturing / Engineering | — | — | |
|
Analog Devices, Inc. is a leading American semiconductor company specializing in data conversion, signal processing, and power management technology. Headquartered in the US, the company designs, manufactures, and markets a wide range of analog, mixed-signal, and digital signal processing integrated circuits. Analog Devices serves various sectors including industrial, automotive, and consumer markets. It was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | Analog Devices id30862 View details | United States | Manufacturing / Engineering | — | — | |
|
Revenue: $12.7B DATA SUMMARY: 570K~ records containing: customer PII and addresses. |
||||||
| Ransomware | Bonava id30863 View details | Sweden | Construction / Real Estate | — | leaked | |
|
Bonava.se is a Swedish company operating in the construction and real estate sector, offering various services related to housing development. Located in Sweden, the company is involved in the development of residential and commercial properties. Bonava.se was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | Bonava id30863 View details | Sweden | Construction / Real Estate | — | leaked | |
|
Revenue: SEK 8B DATA SUMMARY: 842K~ records containing: significant PII, property ownership/interests, warranty and repair cases, contractor information, marketing preferences, and customer service history. |
||||||
| Ransomware | City of Atlanta id30864 View details | United States | Public Sector | — | leaked | |
|
The city of Atlanta's official government website atlantaga.gov provides various services and information to its residents, including public safety, transportation, and community development. As a public sector entity in the US, it offers a range of resources and support to the local community. Atlanta city government was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | City of Atlanta id30864 View details | United States | Public Sector | — | leaked | |
|
DATA SUMMARY: 3M~ records containing: significant PII, citizen service requests, addresses, municipal case history, and internal case management data. |
||||||
| Ransomware | City of Houston id30865 View details | United States | Public Sector | — | leaked | |
|
Houstontx.gov is the official website of the city of Houston, Texas, providing various public services and information to its residents. The city government offers a range of services, including public safety, transportation, and community development. Houstontx.gov is a key resource for citizens, businesses, and visitors, offering access to city news, events, and online services. It was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | City of Houston id30865 View details | United States | Public Sector | — | leaked | |
|
DATA SUMMARY: 6M~ records containing: significant PII, resident contact details, service requests, complaint descriptions, addresses, location data, case/ticket metadata, department routing, service status, resolution information, and extensive CRM metadata. |
||||||
| Ransomware | Viavi Solutions id30866 View details | United States | IT | — | leaked | |
|
Viavi Solutions is a US-based company operating in the IT sector, providing network and service enablement solutions. The company offers a range of products and services to help customers manage and optimize their networks. Viavi Solutions was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | Viavi Solutions id30866 View details | United States | IT | — | leaked | |
|
Revenue: $1B DATA SUMMARY: 430K~ records containing: customer and partner contact information, significant PII, and enterprise account identifiers. |
||||||
| Ransomware | Newcastle University id30867 View details | United Kingdom | Education | — | leaked | |
|
Newcastle University, located in the United Kingdom, is a public research university offering a wide range of academic programs. As an institution in the education sector, it provides various undergraduate and postgraduate degree programs. ncl.ac.uk was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | Newcastle University id30867 View details | United Kingdom | Education | — | leaked | |
|
DATA SUMMARY: 440K~ records containing: applicant and student contact information, significant PII, and admissions data. |
||||||
| Ransomware | District of Columbia Public Schools id30868 View details | United States | Education | — | leaked | |
|
dcps.dc.gov is the official website of District of Columbia Public Schools, providing educational services to students in Washington, D.C. The entity operates within the education sector in the US, offering various academic programs and resources. dcps.dc.gov was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | District of Columbia Public Schools id30868 View details | United States | Education | — | leaked | |
|
[AI generated] District of Columbia Public Schools (DCPS) is a public school district serving Washington, D.C., USA. It operates as the primary government-run K-12 educational system for the nation's capital, overseeing dozens of schools, thousands of students, and a large workforce of educators and administrators. DCPS falls under the education sector and is governed by the D.C. government, focusing on curriculum development, student achievement, and community engagement. |
||||||
| Ransomware | Zenith Bank Plc id30869 View details | Nigeria | Finance / Legal / Insurance | — | — | |
|
Zenith Bank is a financial services provider based in Nigeria, offering a range of banking and financial products to individuals and businesses. The bank operates in the finance, legal, and insurance sector, providing services such as corporate and retail banking. Zenith Bank was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | Zenith Bank Plc id30869 View details | Nigeria | Finance / Legal / Insurance | — | — | |
|
Revenue: ₦2.3T DATA SUMMARY: 90M~ records containing: extensive PII, banking relationships, account information, financial data, government identifiers, customer contact information, and banking support cases. |
||||||
| Ransomware | Frontier Airlines id30870 View details | United States | Transportation / Travel / Logistics | — | leaked | |
|
Flyfrontier.com is a website of Frontier Airlines, a US-based low-cost carrier operating scheduled flights to over 100 destinations. The airline offers a range of travel services, including flights, hotels, and car rentals. Flyfrontier.com is part of the transportation sector, providing online booking and management services to its customers. It was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | Frontier Airlines id30870 View details | United States | Transportation / Travel / Logistics | — | leaked | |
|
Revenue: $1.5B DATA SUMMARY: 2.4M~ records containing: significant PII, customer support cases, flight and travel information, complaint records, baggage details, and customer support email communications. |
||||||
| Ransomware | TaylorMade & Sun Day Red golf id30871 View details | United States | Manufacturing / Engineering | — | leaked | |
|
TaylorMadeGolf.com is the official website of TaylorMade Golf, a leading American golf equipment and apparel manufacturer based in the US. The company designs and produces a wide range of golf clubs, balls, and accessories for professional and amateur golfers. TaylorMade Golf operates in the manufacturing and engineering sector, providing innovative products to the global golf industry. It was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | TaylorMade & Sun Day Red golf id30871 View details | United States | Manufacturing / Engineering | — | leaked | |
|
Revenue: $1.5B DATA SUMMARY: 2M~ records containing: significant PII, customer support history, orders, shipping information, business account data, financial/account information, internal notes, attachments, and AI support chat transcripts. |
||||||
| Ransomware | Allstate id30872 View details | United States | Finance / Legal / Insurance | — | leaked | |
|
Allstate.com is a prominent online presence of The Allstate Corporation, a leading American insurance company headquartered in the US, offering a wide range of insurance products and services to customers across the country. The company operates in the finance and insurance sector, providing various types of insurance coverage, including auto, home, and life insurance. Allstate.com was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | Allstate id30872 View details | United States | Finance / Legal / Insurance | — | leaked | |
|
Revenue: $67B DATA SUMMARY: 657K~ records containing: significant PII, recruitment and licensing information, onboarding data, and internal employee account information. |
||||||
| Ransomware | Microsoft id30873 View details | United States | IT | — | leaked | |
|
Microsoft.com is the official website of Microsoft, a leading American multinational technology company based in the US, operating in the IT sector, and offering a wide range of software, services, and solutions. The company is known for its Windows operating system, Office software, and Azure cloud computing platform. Microsoft.com was listed as a ransomware victim associated with ExfilSquad |
||||||
| Ransomware | Microsoft id30873 View details | United States | IT | — | leaked | |
|
Revenue: $318B DATA SUMMARY: 8M~ records containing: significant PII, employee and customer contact information, authentication data, password hashes, portal identities, corporate account information, business leads, facilities management records, internal service tickets, and access permissions. |
||||||
| Ransomware | Police National Legal Database id30874 View details | United Kingdom | Public Sector | — | leaked | |
|
The Police National Legal Database is a comprehensive legal database utilized by law enforcement agencies in Great Britain, providing access to a wide range of legal information and resources. It operates within the public sector, supporting the work of police forces across the country. The database offers a centralized platform for accessing legislation, case law, and other legal materials. It was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | Police National Legal Database id30874 View details | United Kingdom | Public Sector | — | leaked | |
|
DATA SUMMARY: 135k law enforcement contact records with first/last name, email, police force area, etc. |
||||||
| Ransomware | UK Department for Education id30875 View details | United Kingdom | Public Sector | — | leaked | |
|
Education.gov.uk is the official website of the Department for Education in the United Kingdom, providing information and resources on education policies, initiatives, and services to the public. Located in GB, the website serves as a central hub for education-related inquiries and support. The Department for Education operates within the public sector, overseeing various aspects of education in England. Education.gov.uk was listed as a ransomware victim associated with ExfilSquad. |
||||||
| Ransomware | UK Department for Education id30875 View details | United Kingdom | Public Sector | — | leaked | |
|
DATA SUMMARY: Help Portal (~600K records) – Parent and staff contact records containing full names, email addresses, phone numbers, and job titles. Turing Portal (~7K records) – Contact records containing full names, email addresses, phone numbers, and job titles. |
||||||