← All ransomware groups

Ransomware group profile · #181 by claimed victims

ExfilSquad ransomware

Only exfiltration

Active First seen Jul 2026

15Victims claimed on leak sites

0Victims in the last 30 days

15Victims in the last 90 days

4Countries hit

1Leak-site URLs tracked, 0 online

26 Jul 2026Latest claim recorded

Victimology

Who ExfilSquad claims to have breached, from 15 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Government & Defense4

Technology3

Education2

Financial Services2

Manufacturing2

Transportation1

Retail & E-Commerce1

Top countries

United States10

United Kingdom3

Sweden1

Nigeria1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Wesco International wesco.com	Manufacturing	US	26 Jul 2026
Analog Devices analog.com	Technology	US	26 Jul 2026
Bonava bonava.se	Manufacturing	SE	26 Jul 2026
City of Atlanta atlantaga.gov	Government & Defense	US	26 Jul 2026
City of Houston houstontx.gov	Government & Defense	US	26 Jul 2026
Viavi Solutions viavisolutions.com	Technology	US	26 Jul 2026
Newcastle University ncl.ac.uk	Education	GB	26 Jul 2026
District of Columbia Public Schools dcps.dc.gov	Education	US	26 Jul 2026
Zenith Bank Plc zenithbank.com	Financial Services	NG	26 Jul 2026
Frontier Airlines flyfrontier.com	Transportation	US	26 Jul 2026
TaylorMade & Sun Day Red golf taylormadegolf.com	Retail & E-Commerce	US	26 Jul 2026
Allstate allstate.com	Financial Services	US	26 Jul 2026

All 15 ExfilSquad victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for ExfilSquad is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is ExfilSquad ransomware still active?

ExfilSquad is tracked as active. The most recent leak-site claim VULONE recorded is dated 26 July 2026.

How many victims has ExfilSquad claimed?

VULONE has recorded 15 leak-site victim claims attributed to ExfilSquad since July 2026, across 4 countries and 7 sectors.

Which industries does ExfilSquad target?

The sectors most often named on the ExfilSquad leak site are Government & Defense, Technology, Education.

Which countries are most affected by ExfilSquad?

Most ExfilSquad victims recorded by VULONE are located in United States, United Kingdom, Sweden.

Where does VULONE get ExfilSquad victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].